huawei-cloud-maas-tokens-usage

• Outcome: Review
• Latest audit: Aug 7, 2026 · 2:33 PM UTC
• Version: 1.0.1

Overview

This Huawei Cloud usage skill mostly matches its stated purpose, but it uses cloud credentials with unsafe TLS settings and sends automatic quality reports to a separate service by default.

Review before installing. Use only least-privilege Huawei Cloud credentials, avoid broad account keys, and be aware that this skill disables TLS verification for cloud API calls and sends automatic quality reports to a non-Huawei endpoint by default. Do not use it in sensitive environments unless TLS verification is fixed and telemetry is disabled or explicitly approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 95% confidence
• Finding: The SDK sends telemetry to a network endpoint derived from the SKILL_QUALITY_ENDPOINT environment variable without validation or allowlisting. Because the payload contains execution metadata and potentially skill inputs, outputs, and stack traces, a modified environment can redirect sensitive telemetry to an attacker-controlled server, creating an exfiltration channel.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill uses environment variables, local file reads, and network access but does not declare these capabilities explicitly. Hidden capability use reduces transparency and informed consent, making it harder for reviewers and users to assess data exposure risk, especially because credentials and external requests are involved.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is querying MaaS usage statistics, but the skill also reads credentials from local files and sends execution telemetry to an external operations endpoint. This behavior mismatch is dangerous because users may authorize a harmless-seeming monitoring skill without realizing operational metadata and possibly sensitive context are being exfiltrated to a third party.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill reports trace IDs, status, timing, and masked input/output to an external operations console unrelated to the core task of querying usage statistics. Even if non-blocking, this introduces unnecessary data disclosure and expands the trust boundary to an external service that may collect sensitive operational context.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The troubleshooting example explicitly uses `requests.post(..., verify=False)`, which disables TLS certificate validation and makes HTTPS vulnerable to man-in-the-middle interception or tampering. In a skill that sends AK/SK-signed requests to a cloud API, this is especially dangerous because users may copy the snippet directly, exposing sensitive request contents and weakening transport security for privileged API operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script imports and uses a telemetry/reporting SDK that sends execution metadata to a separate operations console, which is outside the user-visible purpose of querying MaaS usage statistics. Even if described as non-blocking, this creates an undisclosed secondary data flow and may expose usage metadata, timing, parameters, and failure details without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Telemetry to a separate operations console is not necessary to fulfill the stated function of retrieving MaaS usage statistics, so it introduces unnecessary data exposure and hidden network behavior. This is especially concerning in a credentialed cloud utility, where metadata about regions, time ranges, failures, and usage patterns may be sensitive.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements an execution-quality reporting SDK that posts data to an external service, which is unrelated to the stated purpose of querying Huawei Cloud MaaS usage statistics. Such hidden or non-essential outbound telemetry expands the trust boundary and can leak operational or user data beyond what the skill needs to function.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The report path packages input parameters, output results, error messages, and full stack traces for export. For a MaaS statistics query skill, these fields can contain credentials, account identifiers, prompts, service endpoints, or internal errors, and the masking logic is heuristic and incomplete, so sensitive data may still be disclosed.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The markdown provides a concrete HTTPS request example with certificate verification disabled and no warning about the security consequences. Because this is operational troubleshooting guidance, readers are likely to reuse it as-is, normalizing insecure transport behavior in a cloud administration context where signed API requests and usage data traverse the network.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to export long-lived access keys as environment variables and to read a credentials file directly, but it does not include any warning about secret handling, file permissions, shell history, or log exposure. In a verification guide, these examples can normalize insecure credential practices and lead to accidental disclosure through terminal history, screenshots, shared shells, or overly permissive credential files.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script disables TLS certificate verification for all HTTPS requests, which makes the signed IAM and MaaS API calls vulnerable to man-in-the-middle interception and response tampering. Because the tool handles Huawei Cloud AK/SK-signed requests, an active network attacker could observe sensitive metadata and potentially manipulate API responses or exploit trust in the connection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SDK silently transmits execution data to a remote endpoint with no user-facing notice, confirmation, or evident consent mechanism in code. Even if intended for observability, undisclosed outbound reporting is dangerous because users and operators may unknowingly expose sensitive operational and request data.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The SDK documentation explicitly instructs automatic reporting of trace IDs, sanitized inputs/outputs, and stack traces after every skill execution. That design normalizes routine export of execution content to an external operations platform, which is a data-leak risk because sanitization is best-effort and the behavior is broader than the declared MaaS-query purpose.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The decorator/context-manager pattern makes capture and transmission of arguments, results, and exception details automatic for every wrapped skill invocation. This is especially dangerous in a cloud service skill context because wrapped functions may handle API tokens, account data, prompts, endpoints, or error details that should never leave the execution boundary.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

req_headers[k] = v

    url = f"https://{host}{signed_req.uri}"
    return requests.request(method, url, headers=req_headers, data=body, verify=False, timeout=30)


def get_project_id(ak, sk, region):

• Confidence: 99% confidence
• Finding: Using verify=False creates an unsafe default that silently accepts invalid TLS certificates for all outbound API requests. In a cloud-monitoring skill that authenticates with AK/SK, this greatly increases the chance of interception, spoofing, and manipulated results without the user's knowledge.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/maas_rest_usage_stats.py:92