huawei-cloud-storage-query

• Outcome: Review
• Latest audit: Aug 3, 2026 · 9:01 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a read-only Huawei Cloud storage lookup tool, but its setup and network behavior create review-worthy risk while using cloud credentials.

Install only in an environment where Huawei Cloud AK/SK access and storage/account inventory output are appropriate. Review the setup path first: it disables TLS verification and may install remote Python packages, so use a disposable or controlled environment and least-privilege read-only cloud credentials.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while explicitly instructing the agent to execute shell commands, read environment variables for cloud credentials, and make network calls to Huawei APIs. That creates a capability transparency gap: users and reviewers may believe the skill is low-risk/read-only, while it can still access secrets, install dependencies, and reach external services. In a credentialed cloud environment, this hidden capability materially increases the chance of unintended secret exposure or unreviewed code execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is described as a read-only storage query tool, but its documented behavior includes broader IAM project/domain discovery, credential validation, virtual environment creation, and dependency installation. This mismatch is dangerous because operators may authorize it expecting narrow storage-only reads, while it actually expands into identity-scope enumeration and local code execution/bootstrap activity. The discrepancy also weakens user consent and review boundaries, especially where cloud credentials and package installation are involved.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This script exposes tenant/domain project enumeration through CBR by calling list_domain_projects with a user-supplied domain name, which is broader than the declared storage-query scope. Even though it is read-only, enumerating project IDs and names expands reconnaissance capability and may disclose sensitive account structure that can be used to target later attacks or pivot into other cloud APIs.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Accepting a required --domain_name argument and optional project/region parameters adds cross-tenant or broader account-enumeration behavior that is not clearly tied to normal storage resource inspection. In this skill context, that mismatch makes the feature more suspicious because it collects identity and tenancy metadata rather than EVS/OBS/SFS/CBR backup objects, increasing the risk of unauthorized discovery.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This query-only storage skill includes broad environment-management behavior such as attempting to install Python and invoke system package managers. That exceeds the least-privilege expectations for a read-only cloud query tool and increases the blast radius if the script is run on a sensitive host.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script installs and upgrades dependencies from remote package indexes during environment setup, despite the skill's stated read-only storage-query purpose. This creates unnecessary supply-chain exposure and allows execution of downloaded packages as part of a seemingly harmless query workflow, making the context more dangerous.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger list contains broad generic terms such as 'bucket', 'volume', and 'backup', which can cause the skill to activate in unrelated contexts. Unintended invocation is risky here because the skill can execute local scripts, use cloud credentials from environment variables, and make live API calls, so a loose trigger may result in unnecessary cloud enumeration or exposure of sensitive metadata. The dangerousness is elevated by the skill's operational nature and access to credentialed cloud queries.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script downloads `get-pip.py` from the network and executes it automatically, after globally disabling TLS certificate verification elsewhere in the file. This is a severe remote code execution and supply-chain risk: a network attacker or compromised mirror could deliver arbitrary Python code that will run on the host.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script directly prints LDAP configuration fields including the LDAP URL, Base DN, and User DN to stdout. While this is a read-only query tool, these values expose internal directory structure and service endpoints that can aid reconnaissance, especially if command output is logged, shared in terminals, or surfaced through an agent interface to users who should not see identity infrastructure details.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

info("请安装 Python 3.6+ 后重试，参考：")
    print("    Windows : winget install Python.Python.3.11")
    print("    Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip python3-venv")
    print("    CentOS  : sudo yum install -y python3 python3-pip")
    print("    Fedora  : sudo dnf install -y python3 python3-pip")
    print("    macOS   : brew install python@3.11")

• Confidence: 86% confidence
• Finding: At this line the script actually invokes `sudo apt update` via `run_cmd` inside `install_python()`, attempting privileged system modification as part of a storage-query skill. In this context, automatic privileged package management is unnecessarily dangerous and broadens host impact if the script is run under an agent or by an unsuspecting operator.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

print("    Windows : winget install Python.Python.3.11")
    print("    Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip python3-venv")
    print("    CentOS  : sudo yum install -y python3 python3-pip")
    print("    Fedora  : sudo dnf install -y python3 python3-pip")
    print("    macOS   : brew install python@3.11")

• Confidence: 86% confidence
• Finding: This line continues the automatic privileged installation flow by invoking `sudo apt install` and then falling back to other package managers. For a read-only cloud query skill, modifying the host with elevated privileges is outside expected behavior and raises operational and security risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer version, including unexpected major or compromised releases. In a cloud-query skill that depends on multiple vendor SDKs, this increases supply-chain risk and can also introduce breaking API changes that affect authentication or resource-query behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkobs>=3.1.0

• Confidence: 94% confidence
• Finding: Using `>=` without an upper bound permits unreviewed future versions of the IAM SDK to be installed. Because this skill queries cloud resources and likely relies on IAM-authenticated access, a malicious or incompatible upstream release could affect credential handling or broaden the attack surface through supply-chain compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkobs>=3.1.0
huaweicloudsdkcbr>=3.1.0

• Confidence: 94% confidence
• Finding: An unpinned EVS SDK dependency allows the environment to pull in arbitrary newer versions that have not been security-reviewed for this skill. While this file itself is not malicious, the practice exposes the project to dependency confusion, upstream compromise, or incompatible behavior in storage-query operations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkobs>=3.1.0
huaweicloudsdkcbr>=3.1.0

• Confidence: 94% confidence
• Finding: The SFS Turbo SDK is not pinned to a specific version, so package resolution may select a later release with unknown security properties or breaking changes. In a skill that enumerates storage resources, this is primarily a software supply-chain hygiene issue rather than an immediately exploitable application bug.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkiam>=3.1.0
huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkobs>=3.1.0
huaweicloudsdkcbr>=3.1.0

• Confidence: 94% confidence
• Finding: The OBS SDK dependency is open-ended, allowing future untested releases to be installed automatically. Since this skill interacts with object storage metadata and listings, a compromised or incompatible SDK could alter request handling or expose data through unintended behavior, though the risk from this file alone remains low.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkevs>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkobs>=3.1.0
huaweicloudsdkcbr>=3.1.0

• Confidence: 94% confidence
• Finding: The CBR SDK is declared with only a minimum version, which creates nondeterministic builds and admits unreviewed future packages. In a backup-related cloud skill, this could matter if an upstream package is compromised or introduces flawed request/response handling, but the present impact is still limited to supply-chain exposure.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284