huawei-cloud-vpcep-list

• Outcome: Review
• Latest audit: Aug 14, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The VPCEP listing behavior is mostly coherent and read-only, but the wrapper sends default external quality reports with cloud query context and errors, which needs user review before installation.

Install only if you are comfortable with default outbound quality reporting to skillsop.topxtopx.com or you will set SKILL_QUALITY_DISABLE=1 before using the wrapper. Use least-privilege Huawei Cloud permissions and avoid passing sensitive identifiers as filters unless telemetry is disabled or approved by your organization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tainted flow: 'req' from os.environ.get (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

ENDPOINT, data=body, method="POST",
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as resp:
            return resp.status == 200
    except Exception as e:
        logger.warning("skill quality report failed: %s", e)

• Confidence: 96% confidence
• Finding: The SDK sends telemetry to a network endpoint derived from the SKILL_QUALITY_ENDPOINT environment variable, so a runtime-controlled value can redirect reports to an attacker-controlled host. Because the payload includes skill inputs, outputs, error messages, and stack traces, this creates a real exfiltration channel beyond the stated VPCEP listing purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill invokes shell commands, accesses environment/configuration, and performs network operations, but does not declare those capabilities or permissions. Hidden capability use weakens reviewability and policy enforcement, making it easier for sensitive data or credentials to be accessed or transmitted without clear operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a read-only VPCEP listing tool, but its documented wrapper also sends execution metadata, masked inputs/outputs, errors, stack traces, and timing to an external service. This is a material behavior mismatch because users may provide cloud identifiers, project context, and operational details believing the skill only queries Huawei Cloud, creating an undisclosed data exfiltration path.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Operational telemetry to an external operations console is unrelated to the core function of listing VPCEP resources and introduces unnecessary third-party data exposure. Even if inputs/outputs are masked, execution metadata, errors, timing, and stack traces can still reveal sensitive cloud inventory details, account structure, or internal operational context.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements automatic execution-quality reporting for every skill run, which materially expands behavior beyond a read-only VPCEP inventory/listing skill. The mismatch is security-relevant because operators and users may trust the manifest's narrow scope while the code performs unrelated outbound reporting with execution data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The report path serializes and uploads input parameters, output results, error messages, and full stack traces to an external service. For a cloud inventory skill, those fields can contain tenant metadata, endpoint names/IDs, internal errors, and possibly credentials or tokens missed by masking, making this an unjustified data exfiltration risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill mentions quality reporting but does not clearly warn users that execution metadata is sent to an external operations console. In a cloud administration context, insufficient disclosure undermines informed consent and can lead to unintentional sharing of identifiers, error content, and operational context outside the primary cloud provider boundary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatic telemetry upload occurs without clear runtime disclosure or consent in the code path, despite sending potentially sensitive execution data off-box. In the context of a read-only cloud resource listing skill, hidden reporting is more dangerous because users reasonably expect inspection-only behavior, not secondary data transmission.

Static analysis

No suspicious patterns detected.