huawei-cloud-nat-list

• Outcome: Review
• Latest audit: Aug 7, 2026 · 2:18 AM UTC
• Version: 1.0.0

Overview

The skill performs the promised read-only NAT gateway listing, but its recommended wrapper sends run metadata and some query/result data to an external reporting service by default.

Install only if you are comfortable with default external quality reporting from a cloud-inventory skill. Prefer disabling reporting with SKILL_QUALITY_DISABLE=1, use least-privilege NAT read-only IAM credentials, and avoid running the test script with untrusted region or template values.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 96% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares itself read-only, but it has shell, network, and environment-access capabilities without an explicit permissions declaration or constraint model. That creates a trust gap: the agent may execute commands, read credentials from the environment, and make network calls beyond the narrowly described NAT-listing function, increasing the chance of unintended data access or command misuse.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The skill performs execution-quality reporting to an external operations console, which is outside the user-visible purpose of listing NAT gateways. Even if described as non-blocking, this introduces an extra data flow that could leak metadata such as tenant context, request timing, identifiers, errors, or trace IDs to a third party or secondary service without clear necessity.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The installation guide introduces execution reporting to an operations console via a wrapper, which is outside the skill's stated purpose of read-only NAT gateway listing. This creates an undocumented data-flow path and expands the skill's behavior beyond inventory retrieval, increasing the risk of metadata or execution details being exfiltrated without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Telemetry to a skills operations console is not necessary to fulfill the claimed NAT inventory function and therefore represents unjustified capability creep. Even if non-blocking, such reporting can leak usage patterns, resource identifiers, regions, or error details to an external system unrelated to the user's immediate task.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements outbound telemetry/reporting behavior that is unrelated to the skill's declared purpose of listing Huawei Cloud NAT gateways. This mismatch is dangerous because operators may trust the skill as read-only inventory logic while it actually performs additional network transmission of execution details.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The report() function packages trace IDs, timing, status, error details, masked inputs, outputs, and optional stack data, then posts them to an external service. For a tenant-inspection skill, this is unjustified data exfiltration because user-supplied cloud identifiers, query filters, and runtime results may leave the execution environment.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation states that desensitized inputs/outputs and stack information are reported, but the implementation can transmit full exception stacks, which often contain raw values, file paths, identifiers, and unexpected secrets. This discrepancy increases the chance that reviewers underestimate what leaves the system.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The quality-reporting wrapper suggests outbound network communication unrelated to the declared read-only NAT inventory function. Even if framed as telemetry, this expands the skill's trust boundary and could leak metadata, command results, environment details, or usage patterns to an external sink without clear user consent or documentation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide states that each execution is reported and that failures are silent, but it does not disclose what execution data is sent. Silent background reporting without transparent disclosure prevents informed consent and can conceal leakage of sensitive operational metadata such as account context, command parameters, or environment details.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The network transmission logic posts telemetry without any nearby disclosure, prompt, or runtime consent mechanism. Because the skill is positioned as a simple read-only listing tool, hidden collection and export of inputs/outputs materially increases privacy and governance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script executes constructed shell command strings via eval, which causes the shell to re-parse the command and makes variable content such as REGION or other interpolated values part of executable syntax. Because REGION is derived from a JSON file and environment variables, an attacker who can influence those inputs can inject additional shell commands during test execution, leading to arbitrary command execution in the tester's environment.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The module-level description explicitly instructs automatic reporting of execution data, including inputs/outputs and stack traces, to an operations platform. In this skill context, that plain-language behavior normalizes exporting runtime data beyond the read-only NAT-listing purpose and can leak tenant information or exception contents.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The integration examples recommend wrapping the entire skill with automatic reporting, which maximizes capture of caller-provided arguments, outputs, and failures. This broad instrumentation is especially risky for a cloud-management skill because queries and returned resource metadata can be silently forwarded externally.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The payload includes input_param and output_result fields, and these are posted remotely. Even with regex-based masking, sensitive cloud data can evade redaction because resource IDs, error text, and arbitrary structured values are not comprehensively sanitized.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The context manager automatically serializes and reports input, output, retry counts, timeout state, and full exception stack traces at the end of execution. This creates a built-in exfiltration path for runtime data, and stack traces are particularly prone to leaking secrets, identifiers, and internal implementation details.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The decorator summarizes positional and keyword arguments and reports them automatically on success and failure. Although summarized, this still captures caller-controlled data and can leak filters, IDs, names, or other context supplied to the NAT-listing skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.