huawei-cloud-rds-list

• Outcome: Review
• Latest audit: Aug 9, 2026 · 3:47 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a read-only Huawei RDS listing helper, but it automatically sends more execution data than it clearly discloses to an external reporting endpoint.

Install only if you are comfortable with default external quality reporting. Before use, set SKILL_QUALITY_DISABLE=1 or require an audited endpoint if cloud inventory names, IDs, VPC IDs, regions, errors, or stack traces are sensitive. Use a dedicated Huawei Cloud IAM identity with RDS read-only permissions, and avoid the curl-to-bash installer unless you have verified the source through your normal software supply-chain process.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 97% confidence
• Finding: with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell commands, uses environment-derived credentials/configuration, and performs network access, yet no explicit permission declaration is present. This weakens review and sandboxing because operators may treat the skill as lower risk than it is, while it can still execute commands and communicate externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to be a read-only RDS listing utility, but it also sends execution telemetry to an external service, including masked inputs, outputs, and potentially failure details. This creates a confidentiality and trust problem because tenant inventory data, operational metadata, and error context may leave the expected Huawei Cloud boundary without prominent user consent.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Per-invocation reporting to an external operations console expands the data flow beyond the stated task of listing RDS instances. Even if non-blocking, it can leak sensitive cloud inventory information and create an unexpected exfiltration channel tied to every use of the skill.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The verification document states that every run reports metadata to an operations console, which introduces outbound data transmission beyond the skill's advertised purpose of listing RDS instances. Even if the reported fields are limited to trace ID, status, error code, and cost, this is still undisclosed telemetry by default and creates privacy, compliance, and trust risks for users operating in sensitive cloud environments.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Automatic reporting to an operations console exceeds the behavior described in the skill metadata, which claims a read-only RDS listing function. This mismatch is security-relevant because users may approve execution expecting a local read-only inventory action, while the skill also performs network egress to an external system, potentially leaking operational context or execution metadata.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill performs external telemetry reporting on every run even though its stated purpose is only to list RDS instances. In this context, the reported metadata includes query parameters such as region, instance name, instance ID, VPC ID, and truncated results, which can expose cloud inventory details to an unrelated operations console and violate least-privilege and data-minimization expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says the skill is read-only and only lists RDS instances, but this code performs outbound HTTP reporting to an external service. That contradiction matters because users and reviewers may permit the skill under a low-risk assumption, while it actually transmits runtime data off-box.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This code captures and reports input parameters, output results, error messages, and stack traces, which exceeds the stated purpose of listing RDS instance names. In this skill context, those fields may contain cloud inventory details, internal errors, credentials in exception paths, or other tenant-sensitive information, making the mismatch especially dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The SDK introduces a general external telemetry capability that is not necessary for a simple inventory-listing skill. Even if intended for observability, adding undeclared egress increases attack surface and can enable data leakage or policy violations in environments expecting a local, read-only helper.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill does not clearly warn users that invocation metadata is sent to an external operations console, undermining informed consent and safe handling of potentially sensitive cloud asset data. In the context of a tenant inventory skill, even names, IDs, statuses, and failure traces can reveal valuable infrastructure details to unauthorized recipients.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide recommends executing a network-fetched installer directly with `curl ... | bash`, which removes any opportunity to inspect, verify, or pin the downloaded code before execution. If the remote host, object storage path, DNS, TLS trust chain, or installer content is compromised, this becomes arbitrary code execution on the machine running the command.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation describes default telemetry/reporting without a prominent warning that data is transmitted externally unless disabled. In enterprise cloud environments, even seemingly low-sensitivity execution metadata can reveal account activity patterns, usage timing, regions, failure states, and internal operational details, making silent default reporting inappropriate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automatically performs network reporting without any user-facing warning, consent, or clear control at call time. Hidden transmission of execution data is risky because operators may provide cloud/account context to a tool they believe only queries Huawei RDS and prints results locally.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The module explicitly instructs collection and transmission of trace IDs, sanitized inputs/outputs, error codes, and stack data to an external operations platform. In a cloud inventory skill, even partially masked runtime data can reveal tenant structure, resource names, internal failures, and other sensitive operational details.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The payload explicitly includes input parameters, output results, error messages, and full stack traces for outbound transmission. The masking is limited and pattern-based, so secrets, cloud identifiers, database endpoints, or unexpected sensitive values can still leak, especially through exception messages and traces.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.