huawei-cloud-network-query

• Outcome: Review
• Latest audit: Aug 16, 2026 · 3:36 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a read-only Huawei Cloud query tool, but it disables TLS verification and includes default external telemetry, which makes it unsafe to approve without review.

Review before installing. Use only least-privilege read-only Huawei Cloud credentials, prefer temporary credentials, set SKILL_QUALITY_DISABLE=1 unless you explicitly accept external reporting, and avoid using the skill with sensitive environments until TLS verification is enabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (33)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 97% confidence
• Finding: The SDK sends telemetry to a URL taken from the SKILL_QUALITY_ENDPOINT environment variable without any allowlist or trust validation. An attacker who can influence the runtime environment can redirect reports to an arbitrary host and receive skill inputs, outputs, error messages, and stack traces, turning this into a data-exfiltration channel.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as a read-only query tool but explicitly requires shell execution, environment-variable access, and network access without declaring those capabilities as permissions. That creates a transparency and trust boundary problem: users may authorize or invoke the skill without understanding that it can execute local scripts, inspect credentials, and reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the advertised 'read-only network query' purpose by installing dependencies, creating/re-execing into a virtual environment, validating credentials against IAM, auto-resolving project IDs, and sending execution telemetry to an external operations endpoint. Even if no cloud resources are modified, these extra behaviors expand the attack surface and can expose account metadata or operational data without clear prior consent.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code explicitly sets `http_config.ignore_ssl_verification = True`, disabling TLS certificate validation for Huawei Cloud API requests. This enables man-in-the-middle interception or tampering with cloud API traffic, which is especially dangerous here because the skill handles AK/SK credentials, security tokens, and sensitive network/security configuration data.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code explicitly creates an unverified SSL context and uses it for an HTTPS request, which disables server certificate validation. This allows a man-in-the-middle attacker to intercept or spoof the DNS API endpoint response, causing the tool to trust tampered version data and potentially mislead later operational or security decisions.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code creates an unverified TLS context with ssl._create_unverified_context() and uses it for the anonymous HTTPS request, which disables server certificate validation. This enables man-in-the-middle interception or spoofing of the Huawei Cloud endpoint, so the script may accept attacker-controlled responses or be redirected without detection.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This helper automatically creates a virtual environment and re-executes itself, expanding the skill from a read-only cloud query tool into a local environment-mutating installer. In the context of a network-query skill, that behavior is unnecessary and increases attack surface because invoking the skill can modify the host system without explicit user approval.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script invokes privileged system package managers including sudo apt/yum/dnf to install Python, which can change the host OS and execute package-maintainer scripts with elevated privileges. That is disproportionate to the declared purpose of a cloud network query skill and could be abused to perform broad system changes on the user's machine.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The code globally disables HTTPS certificate verification by replacing the default SSL context, which breaks TLS authenticity checks for all urllib HTTPS requests in the process. Combined with downloading bootstrap code from the network, this enables man-in-the-middle interception and remote code execution through tampered installer content.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The credential validation step calls IAM ListUsers rather than limiting itself to the network resources advertised by the skill. This broadens data access beyond the stated read-only network topology purpose and can expose identity metadata unnecessarily.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file belongs to a Huawei Cloud network-query skill, but it contains a generic telemetry uploader that sends execution data to an unrelated external service. That behavior is outside the declared read-only network-query purpose and materially increases data exposure risk because the skill may process cloud topology, DNS, VPN, and security-group details.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The report payload explicitly includes input_param, output_result, error_msg, and full_stack, and these are uploaded to a remote endpoint. For a cloud network-query skill, those fields can contain sensitive infrastructure metadata, credentials that evade masking, internal hostnames, DNS records, VPN details, or exception traces, creating direct exfiltration risk.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Overly broad trigger terms such as generic single words can cause the skill to activate on unrelated requests, increasing the chance that credentialed scripts run in contexts the user did not intend. In a skill that executes local code and calls cloud APIs, overbroad activation materially raises the risk of unnecessary data exposure and unintended outbound requests.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill requires environment validation and query execution that will transmit credential-derived account metadata and queried resource data to Huawei Cloud APIs, but this data-flow is not prominently disclosed in the user-facing description. Users may believe they are only performing a local lookup when in reality the skill contacts external cloud endpoints and reveals tenancy/project context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill discloses that scripts report trace IDs, status, error codes, and execution cost to an external operations console, yet this telemetry is not prominently surfaced up front and is enabled by default unless manually disabled. Silent third-party telemetry from a credentialed cloud-query skill can leak operational metadata, usage patterns, and possibly identifiers beyond the primary cloud provider boundary.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This finding is substantively the same issue as above: the anonymous HTTPS request disables certificate verification and gives no warning to the user. In a cloud-network-query skill, silently accepting unverifiable TLS increases risk because operators may rely on the returned service metadata as authoritative while an attacker can tamper with it in transit.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script not only disables TLS verification for the anonymous request, but also gives no warning to the user that HTTPS protections are being bypassed. In a network-query skill, users are likely to trust returned topology or version data; suppressing certificate validation without disclosure increases the chance of silent data tampering or endpoint impersonation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script automatically creates a venv and re-executes without a clear up-front warning or confirmation, causing local system changes outside the skill's apparent read-only purpose. Silent environment mutation is dangerous in agent contexts because users may not expect code execution that alters the host runtime.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill reads cloud credentials from environment variables and later uses them for live API validation without clearly warning the user that sensitive credentials will be transmitted to Huawei Cloud endpoints. In agent settings, inadequate disclosure around credential use increases privacy and trust risks even if the values are not printed.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: This code downloads get-pip.py from the network and executes it locally, which is remote code execution by design. Because the script also disables TLS verification elsewhere, an attacker in a MITM position could replace the bootstrap script and gain arbitrary code execution on the host.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Automatic execution of sudo-capable package-manager commands lacks explicit confirmation and can trigger privileged system modifications unexpectedly. In a skill advertised for cloud querying, this mismatch makes the behavior especially risky because users are less likely to anticipate host-level changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The SDK performs remote telemetry uploads silently in normal execution flow, with no user-facing notice or runtime confirmation at the point of transmission. Silent export of execution data increases the chance that sensitive cloud-query context is sent externally without operator awareness or informed approval.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script outputs sensitive operational data for active P2C VPN connections, including client IP addresses, virtual IPs, usernames, and traffic statistics, directly to stdout. In the context of a network-query skill, this can expose user-identifiable and security-relevant information to anyone who can invoke the skill or access its logs, enabling reconnaissance and privacy leakage even though the script performs no write operations.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The module documentation itself states that every skill execution reports desensitized inputs/outputs and stack traces to an operations platform. Even with masking, regex-based desensitization is incomplete and unsuitable for sensitive cloud-query results, so the design normalizes broad external disclosure of operational data.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The recommended decorator/context-manager integration makes capture and forwarding of arguments and results the default behavior for all skill invocations. That broad, automatic instrumentation is especially risky in a network-query skill because normal outputs may include internal network architecture and security configuration information.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/dns/list_api_versions.py:39

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/elb/list_api_versions.py:39

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284