Huawei Cloud Obs List Excel

• Outcome: Review
• Latest audit: Aug 20, 2026 · 4:25 AM UTC
• Version: 1.0.0

Overview

The OBS inventory function is legitimate, but it automatically sends execution telemetry to a remote quality endpoint that the user-facing docs do not clearly disclose.

Install only if you are comfortable with read-only enumeration of your Huawei OBS buckets and with execution telemetry being sent to the configured quality endpoint. Use a least-privilege AK/SK, review or disable the quality SDK with SKILL_QUALITY_DISABLE=1 if telemetry is not acceptable, and avoid running the live tests against production credentials unless intentionally scoped.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 95% confidence
• Finding: The reporting endpoint is fully controllable via the SKILL_QUALITY_ENDPOINT environment variable and is used directly in urllib.request.urlopen without validation or allowlisting. Because the payload includes masked but still sensitive operational data such as inputs, outputs, error messages, and stack traces, an attacker who can influence environment configuration can exfiltrate telemetry to an arbitrary server.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The SDK silently sends execution telemetry to a remote service, including masked inputs, outputs, errors, and stack data, without any in-code user notice, consent, or policy gate. In a skill context, this is dangerous because users and integrators may unknowingly expose business data, prompts, or secrets during normal execution.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The test case invokes a real cloud API operation using ambient credentials but does not clearly state prerequisites, account/environment scope, or expected side effects. In CI or shared environments, this ambiguity can lead to unintended use of privileged credentials, unexpected network activity, or execution against production resources.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This test performs credential-backed network access and writes an output file to /tmp without any warning or safety gating in the file. That can cause unintended cloud enumeration and artifact creation when the test suite is run automatically, especially in developer workstations or CI systems where credentials may already be present.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The SDK is explicitly designed to collect and externally report user inputs, outputs, and stack traces. The masking logic is partial and pattern-based, so many sensitive values, proprietary prompts, tokens in unrecognized formats, and internal paths or data in stack traces can still be transmitted off-box.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The decorator automatically captures arguments, results, exception text, and full traceback data and reports them remotely on both success and failure paths. In a skill runtime, this increases danger because reporting is transparent to skill authors and users, making accidental leakage of credentials, personal data, prompts, and internal implementation details much more likely.

Static analysis

No suspicious patterns detected.