huawei-cloud-iam-query

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:12 AM UTC
• Version: 1.0.0

Overview

The skill appears to run read-only Huawei IAM queries, but its setup and network handling are risky enough to require review before installation.

Install only if you are comfortable with a skill that uses Huawei Cloud AK/SK credentials, creates a local Python environment, installs packages, and prints sensitive IAM inventory. Prefer running it in an isolated environment with least-privilege read-only credentials, avoid proxies or networks you do not control, and review or patch the TLS verification and output-redaction behavior first.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares itself as a simple read-only query tool, but its documented execution model requires environment-variable access, shell execution, and network connectivity without explicitly declaring or constraining those capabilities. Hidden capability expansion is risky because it can surprise operators and increase the blast radius if the skill or bundled scripts are compromised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior goes far beyond read-only IAM queries by permitting dependency installation, virtualenv/bootstrap logic, remote downloads, OS-level package installation, and even SSL-verification bypass. These actions materially increase supply-chain and code-execution risk, and disabling certificate validation can expose credentials and query traffic to man-in-the-middle attacks.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The skill is presented as Huawei Cloud IAM-only, but the body documents a generic cloud resource discovery workflow covering non-IAM assets such as specs, images, disks, and dependency mapping. This scope confusion can cause the agent to access a much broader set of cloud metadata than users expect, undermining least privilege and informed consent.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: Contradictory documentation about the skill's true scope creates an opportunity for overbroad execution under a narrower trust label. Users may approve an IAM inspection skill while actually enabling a general cloud-query tool with access to more resources and metadata than anticipated.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code disables TLS certificate verification by setting ignore_ssl_verification = True and suppresses the resulting warnings, making man-in-the-middle interception of IAM API traffic much easier. Because this skill handles cloud access credentials and queries sensitive identity data, an attacker controlling the network path or proxy could capture credentials or tamper with responses without visible alerts.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is described as a read-only IAM query capability, but this helper creates virtual environments and re-executes under a different interpreter, expanding its behavior beyond simple querying. That broader execution surface makes the skill more dangerous in an agent setting because running it changes the local environment rather than only reading cloud state.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This section installs packages and, if pip is missing, downloads and executes remote bootstrap code, which is far outside the stated read-only IAM scope. In an agent environment, that can lead to unintended code execution and supply-chain compromise on the host, especially because the script actively fetches code from the internet.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script invokes system package managers such as apt, yum, dnf, brew, and winget, causing host-level changes unrelated to querying IAM data. In a supposedly read-only cloud-inspection skill, this is dangerous because it crosses trust boundaries and may modify the operating system or require elevated privileges.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The script globally disables TLS certificate verification by overriding Python's default HTTPS context, then uses network downloads for setup. This makes man-in-the-middle interception feasible and is especially severe because the same script may retrieve and execute bootstrap code, turning a network attacker into a code-execution attacker.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The instructions require running environment validation that checks credentials, installs dependencies, and validates service availability, yet they do not provide a clear upfront warning that network access and credential use will occur. This weakens informed consent and may lead users to expose secrets or initiate external communication unexpectedly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This section documents read-only commands that enumerate highly sensitive IAM data such as access key identifiers, MFA device state, and last-used authentication metadata, but it provides no warning about handling or disclosing the output. In an agent skill context, that omission increases the chance that operators or downstream tooling will surface credential-adjacent identity data into logs, chat transcripts, or other insecure channels.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The guide describes commands that reveal authentication and identity-provider configuration details, which can materially aid reconnaissance by exposing federation, protocol, mapping, or compliance configuration information. Even though the scripts are read-only, documenting these capabilities without cautionary guidance can lead to unnecessary exposure of security architecture details through routine agent use.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script prints IAM access key metadata, including access_key_id and user_id, directly to stdout without any masking, warning, or output-scope control. While it does not expose secret keys, access key identifiers are still sensitive inventory data that can aid credential enumeration, account mapping, phishing, or targeting of specific identities if logs, transcripts, or tool outputs are exposed to unauthorized parties.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script prints the full OpenID Connect configuration directly to stdout, including the signing_key and other identity-provider details. In a CLI/tooling context, stdout is often logged, copied into tickets, or exposed to other operators, so this can leak security-sensitive federation configuration that may aid reconnaissance or mishandling of trust material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script retrieves and prints detailed IAM user attributes including email, phone, domain/account identifiers, password status, password strength, and login timestamps directly to stdout. In many operational environments, stdout is captured by terminals, shell history wrappers, CI logs, agent transcripts, or centralized logging systems, which can unintentionally expose sensitive identity and security metadata to broader audiences than intended.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 94% confidence
• Finding: The dependency is only lower-bounded and not pinned to an exact version, so installs may pull in newer releases with breaking changes or a compromised upstream package version. Because this skill interfaces with cloud IAM data through an SDK, a malicious or vulnerable transitive update could affect credential handling, request signing, or sensitive identity query results.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 94% confidence
• Finding: This package is also unpinned, which creates supply-chain risk by allowing different environments to resolve different versions over time. In the context of an IAM-query skill, even read-only operations can expose highly sensitive identity, policy, MFA, and access-key metadata if a compromised SDK release is installed.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284