huawei-cloud-sfsturbo-list

• Outcome: Review
• Latest audit: Aug 17, 2026 · 9:17 AM UTC
• Version: 1.0.1

Overview

The skill is a read-only Huawei Cloud SFS listing tool, but it also sends default-on execution reports to an external operations endpoint with more runtime detail than the main documentation clearly scopes.

Review before installing in sensitive cloud environments. The SFS operations themselves are read-only, but the wrapper reports execution quality externally by default; set SKILL_QUALITY_DISABLE=1 or restrict SKILL_QUALITY_ENDPOINT if you do not want region, project_id, status, errors, or stack details leaving the runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 94% confidence
• Finding: The SDK sends telemetry to an endpoint taken from an environment variable, so whoever controls the runtime environment can redirect all captured execution data to an arbitrary external server. Because the payload includes skill metadata and may include masked-but-still-sensitive inputs, outputs, and error details, this creates a real exfiltration channel and SSRF-like outbound communication risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill invokes shell commands, uses environment-controlled behavior, and can access networked cloud APIs, yet no explicit permission declaration is present. That mismatch weakens review and containment because consumers may assume the skill is purely declarative/read-only while it can execute commands and exfiltrate inventory data over the network.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a telemetry/reporting SDK even though the skill manifest describes a read-only Huawei Cloud SFS listing capability. That mismatch is security-relevant because operators and users would reasonably expect inventory-only behavior, not hidden runtime data collection and transmission.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code posts execution data to an external quality-report endpoint unrelated to the stated SFS-listing function. In the context of a cloud inventory skill, exporting runtime data off-platform is especially dangerous because user queries, cloud resource details, and operational metadata may be disclosed to an unexpected third party.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The reporting logic captures input parameters, output results, error messages, and full exception stacks, then forwards them remotely. Even with basic regex masking, stack traces and serialized payloads can still contain credentials, tenant identifiers, file-system metadata, tokens in unexpected formats, or internal implementation details, leading to data leakage beyond the skill's declared purpose.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module documentation normalizes automatic execution reporting as a standard integration path, which conflicts with the manifest's representation of the skill as a simple read-only SFS query tool. This increases the chance that maintainers will unknowingly deploy hidden telemetry, undermining transparency and informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SDK transmits inputs, outputs, and stack traces to a remote service without any visible user-facing notice or consent mechanism in the code. For a cloud-management skill, silent telemetry materially increases privacy and data-handling risk because users may supply account, region, and resource information they do not expect to leave the execution environment.

Static analysis

No suspicious patterns detected.