huawei-cloud-icp-rule-consult

• Outcome: Pass
• Latest audit: Aug 3, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

This is a read-only Huawei Cloud ICP filing consultation skill; its web helpers are broader than ideal, but the behavior is disclosed and aligned with document lookup rather than account changes or data theft.

Install only if you want a Huawei Cloud ICP filing reference assistant. Keep it to read-only consultation, prefer embedded knowledge and fixed Huawei documentation URLs, avoid remote Chrome unless it is your trusted browser endpoint, and install current patched dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly instructs use of Python scripts that perform HTTP fetching, Playwright browsing, and environment-variable use, yet no permissions are declared. This creates a mismatch between documented behavior and the platform's declared trust boundary, making network access and env-derived configuration harder to review, constrain, or audit.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The search implementation is materially broader than the skill manifest: it exposes a general Playwright-driven web search workflow rather than a narrowly constrained ICP-rules lookup. In an agent environment, this expands the reachable web surface and can enable unintended browsing behavior, policy bypass, or retrieval from unapproved sources if another component passes arbitrary queries or domains.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code connects to a caller/environment-controlled remote Chrome endpoint and trusts the returned webSocketDebuggerUrl without any authentication or allowlisting. In practice this can route browsing activity through untrusted infrastructure, expose session data and fetched content to a third party, or let a malicious endpoint influence browser behavior well beyond the read-only ICP consultation purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The search API accepts an arbitrary site parameter and constructs a base URL from it, which is broader than necessary for a Huawei Cloud ICP consultation skill. Even though it defaults to support.huaweicloud.com, this design allows the tool to be repurposed for general browsing against attacker-chosen domains, increasing data exposure and reducing source trustworthiness.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases in this range are broad enough to match ordinary ICP-related discussion without enough disambiguation, which can cause the skill to activate outside its intended scope. In a routing catalog, overbroad activation is a security-relevant quality issue because it can hijack user intent, suppress more appropriate handlers, or produce authoritative compliance guidance when the user did not clearly ask for this skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This trigger set includes shorthand and competitor-brand phrases that are ambiguous and likely to appear in general cloud migration or support contexts, not just access filing. That increases the chance of misrouting user requests into a compliance consultation flow, which is especially risky because regulatory advice may be given based on an incorrect inferred intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrases in this entry are highly generic account-related terms that can match many normal IAM, billing, identity, or account-management conversations unrelated to ICP filing. Because the skill is supposed to be used only for explicit filing topics, these triggers weaken boundary enforcement and can cause unintended activation and misleading answers in unrelated administrative workflows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Isolated technical tokens such as public key or signature MD5 are too generic to safely trigger a filing skill because they are common in development, security, and mobile release discussions. In this context, the catalog may capture unrelated app-signing questions and respond with filing guidance, creating confusion and reducing trust in routing accuracy.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The boundary section uses broad infrastructure and support phrases that are likely to appear in many unrelated cloud conversations, so it can over-capture traffic simply to classify it as out-of-scope. Even though this entry is meant to enforce boundaries, overly broad boundary triggers still create a routing vulnerability by intercepting unrelated requests and potentially blocking the correct downstream skill or support path.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The knowledge base explicitly treats vague inputs like “备案咨询” and “备案” as requiring follow-up rather than providing a hard gating rule, which can encourage activation on very broad user utterances. In an agent setting, overly broad trigger scope can cause the skill to engage outside its intended domain, increasing the chance of misrouting, policy bypass, or answering adjacent requests it is supposed to refuse.

Known Vulnerable Dependency: requests==2.32 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: requests==2.32

Known Vulnerable Dependency: aiohttp==3.9.5 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: aiohttp==3.9.5

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.