huawei-cloud-obs-list-folders

• Outcome: Review
• Latest audit: Aug 7, 2026 · 7:21 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a read-only Huawei OBS listing tool, but it automatically sends execution telemetry, including user parameters and error details, to an external operations endpoint by default.

Review this skill before installing in environments where bucket names, prefixes, error details, or cloud account activity are sensitive. Use least-privilege OBS read-only credentials, avoid pasting AK/SK into chat or files, and set SKILL_QUALITY_DISABLE=1 unless you explicitly want execution reports sent to the skillsopr operations endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 95% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes shell commands, uses environment-derived configuration, and performs networked operations, yet no explicit permissions are declared. This creates a trust and review gap: consumers may treat the skill as low-risk/read-only while it can execute external programs and communicate over the network, increasing the chance of unexpected data exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to be a read-only OBS inspection tool, but it also sends execution telemetry to an external HTTP endpoint, including operational metadata such as errors, timing, stack traces, and masked input/output. This is a meaningful behavior mismatch because users may provide bucket names, prefixes, or troubleshooting context expecting only cloud-provider interaction, while data is also transmitted to a third-party service.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The verification document states that every wrapper-script run reports a trace ID, status, error code, and timing data to an external operations console. That behavior exceeds the skill's stated OBS read-only listing purpose and creates an undocumented outbound data flow that could disclose operational metadata or user activity patterns without explicit user consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation introduces a quality-reporting mechanism via a vendored SDK that is unrelated to the core function of listing buckets and folders. Hidden or undeclared secondary behavior is dangerous because it expands the skill's effective capabilities beyond the manifest, undermining trust boundaries and potentially transmitting execution metadata off-system.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements a telemetry/reporting client that performs network exfiltration, which does not match the skill's stated purpose of read-only OBS bucket/folder listing. Hidden side-effectful reporting broadens the trust boundary and can leak operational or user data without necessity. Because users would reasonably expect a listing skill to only query OBS, the mismatch materially increases risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The report path packages and uploads execution data including sanitized inputs, outputs, error messages, and potentially full stack traces to an external service. Even with partial masking, sensitive bucket names, prefixes, object metadata, internal paths, and secrets embedded in exceptions may still be disclosed. For a simple inventory/listing skill, this collection and transmission is unnecessary and constitutes unjustified data exfiltration.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation describes routine quality fields but the implementation also transmits output results and full stack traces, which can contain far more sensitive information than users or integrators would expect. This discrepancy undermines informed consent and increases the likelihood that the SDK is deployed in contexts where sensitive data is silently leaked.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation mentions non-blocking quality reporting to an operations console but does not present it as a prominent user-facing warning or consent boundary. Even if the reported data is operational in nature, silent transmission of execution metadata can leak sensitive bucket names, prefixes, error details, or contextual prompts into external systems without informed user consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Telemetry reporting to an operations console is described, but there is no user-facing warning that execution metadata will be transmitted externally. Even if the payload is limited, undisclosed transmission can leak sensitive environment, usage, and failure information and is especially concerning in a skill presented as a simple read-only storage inspection tool.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The SDK performs silent outbound transmission of telemetry including execution-derived data without any user-facing warning or consent mechanism in the skill. Even over HTTPS, undisclosed collection of inputs, outputs, and errors creates privacy and compliance risk, especially in enterprise cloud environments where bucket and path names may be sensitive.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file declares that HUAWEI_ACCESS_KEY and HUAWEI_SECRET_KEY must be present, but provides no adjacent warning or handling guidance about sensitive credential use. In practice, this can lead to operators supplying cloud credentials to run tests without understanding scope, storage, masking, or least-privilege expectations, increasing the chance of credential exposure or misuse.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The SDK explicitly instructs operators that user inputs, outputs, and stack traces will be reported to an external operations platform. Those fields can reveal sensitive cloud resource names, access patterns, internal code paths, and exception details, making this a direct data disclosure mechanism. In a read-only OBS listing skill, such reporting is disproportionate to the functional need.

Ssd 3

High

• Confidence: 94% confidence
• Finding: The examples recommend wrapping the entire skill with an automatic reporter, causing all arguments and results to be captured by default. This encourages unsafe adoption patterns where sensitive runtime data from otherwise simple cloud-listing operations is routinely exported off the system. The skill context makes this more dangerous because users would not expect mere folder enumeration to trigger broad telemetry capture.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The exception handling path sends inferred error codes, error messages, and full exception stack data to the remote endpoint, alongside summarized input parameters. Stack traces frequently contain file paths, library versions, internal logic details, and occasionally secrets present in exception text, so this is a concrete sensitive-data exfiltration channel.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.