Security audit

huawei-cloud-monitoring-query

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a read-only Huawei Cloud query helper, but it disables HTTPS certificate verification while using cloud credentials and installing dependencies.

Review before installing. Use only a least-privilege Huawei Cloud account, avoid long-lived AK/SK where possible, and do not run this on networks or hosts where disabled TLS verification could expose credentials or dependency downloads to interception. Prefer a version that keeps certificate verification enabled and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares itself as a read-only query tool but instructs the agent to execute local shell commands, read environment variables, and make outbound network calls without any explicit permission declaration. This expands the effective trust boundary and can lead to unintended command execution, credential exposure risk, or network activity in environments that rely on declared permissions for policy enforcement.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior goes beyond read-only CES/EPS querying by performing environment modification, dependency installation, virtualenv creation, possible system-level package installation, and IAM credential validation/lookups. This mismatch is dangerous because users or policy engines may authorize the skill based on a benign description while it actually performs privileged local changes and broader cloud-account interactions.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation says the skill only supports CES/EPS, but it also instructs the agent to retrieve project IDs via IAM. Even if used for a legitimate prerequisite, this is still broader service access than advertised and can mislead operators about the scope of cloud APIs and permissions being exercised.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: Including IAM in the core commands contradicts the claim that non-CES/EPS services are unsupported. This inconsistency weakens operator understanding of the actual execution surface and can result in overbroad authorization or unnoticed identity-service access during use.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script globally disables HTTPS certificate verification by overriding ssl._create_default_https_context, which affects all subsequent TLS connections in the process. In an environment-preparation script that downloads bootstrap code and installs dependencies, this enables man-in-the-middle tampering and could lead to malicious package or script execution, making the monitoring-query context more dangerous because the script also handles cloud credentials.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill is described as a read-only Huawei monitoring/EPS query tool, but this script performs local environment mutation, package installation, and system package-manager actions. That capability expansion increases attack surface and user impact because running a supposedly read-only cloud query skill can modify the host system and fetch code from external sources.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Disabling TLS verification without warning causes all HTTPS operations in the process to trust any certificate, silently defeating transport authentication. In this file, that directly undermines mirror probing, bootstrap downloads, and API validation flows, creating a realistic path to dependency or traffic interception.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 93% confidence
Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer, unreviewed versions. This increases supply-chain risk because a compromised or breaking upstream release could be pulled into the skill without any code changes in the repository.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 93% confidence
Finding: Using an unpinned IAM SDK dependency allows dependency resolution to select newer versions than the author tested. If an upstream package is malicious, compromised, or introduces security-relevant behavior changes, deployments could silently consume that version.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 93% confidence
Finding: The CES SDK is not pinned to an exact version, which makes builds non-reproducible and exposes the skill to upstream supply-chain changes. In a cloud-monitoring integration, dependency trust is important because the SDK handles authenticated API communication and access to monitoring metadata.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 93% confidence
Finding: The EPS SDK dependency is unpinned, so installations may pick up unexpected later releases. While this file does not itself execute code, the package will be installed and imported elsewhere, making upstream compromise or incompatible behavior a realistic supply-chain concern.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284