huawei-cloud-network-query

Security checks across malware telemetry and agentic risk

Overview

This is mostly a read-only Huawei Cloud network inventory skill, but its setup and network handling create meaningful security risk for users supplying cloud credentials.

Review before installing. Use only least-privilege, read-only Huawei Cloud credentials, preferably temporary credentials. The publisher should remove TLS verification bypasses, avoid downloading executable bootstrap code at runtime, pin dependencies, and require clear consent before environment changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The documentation broadens the skill from network-resource queries to images, disks, and generic cloud specifications, which conflicts with the manifest and expected trust boundary. This scope drift increases the chance of unintended invocation and overbroad access to cloud inventory data that users did not intend to expose.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: A skill advertised as read-only network querying should not automatically create execution environments and replace the running process. This expands the skill's capabilities from passive cloud reads into local system modification and execution flow control, increasing attack surface and violating least privilege for the declared purpose.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script automatically installs Python and packages using OS package managers and pip, which is unrelated to the stated read-only cloud-query function. In skill context, this is more dangerous because users may trust the skill as non-destructive while it can alter the host system and installed software.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Credential validation sends AK/SK to live IAM endpoints and performs user-listing, which is outside the narrow network-resource query scope described for the skill. Although not overtly malicious, it broadens data access into identity inventory and can expose sensitive account metadata if misused.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This helper enables execution of arbitrary OS commands and is later used for package-manager and pip operations, which are unjustified for a read-only network-query skill. The context makes it riskier because the skill claims no write operations, yet includes a generic command-execution primitive for host modification workflows.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script exposes traffic mirror session data, but the skill metadata/manifest described to users does not explicitly include traffic mirroring resources. This creates a capability mismatch: operators may invoke the skill believing it only covers the declared resource set, while it can also enumerate potentially sensitive network observability configurations that reveal monitored traffic paths, targets, and filters. In a security-sensitive cloud environment, undeclared read access is still meaningful because it increases data exposure and weakens review and least-privilege assumptions.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger list includes generic terms such as 'network' and 'security group', which can cause the skill to activate in contexts broader than Huawei Cloud network inventory queries. Overbroad invocation is risky here because activation can lead to shell execution, environment inspection, dependency installation, and cloud API access without the user specifically requesting those actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs automatic environment validation and dependency installation, including package/bootstrap actions, without clear user-facing warnings that the local system may be modified. This is dangerous because a supposedly read-only query skill can alter the runtime environment, introduce supply-chain risk through package installation, and surprise users with persistent system changes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide explicitly documents commands that retrieve certificate details and a private-key-related echo setting, but provides no warning that these outputs can reveal sensitive certificate metadata or security-relevant configuration to users of the skill. In a cloud network inventory skill, exposing certificate domains, fingerprints, common names, expiration data, and especially the state of private-key echo behavior can materially aid reconnaissance and increase the chance of accidental disclosure through logs, transcripts, or downstream tooling.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script creates a virtual environment and transparently re-executes itself without explicit confirmation. Even if less severe than sudo-based installation, silent local environment modification and process replacement are unexpected side effects for a read-only query skill and weaken informed consent.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script invokes system package managers with sudo-capable commands to install Python automatically, without an explicit confirmation gate. In the context of a cloud-query skill, this is a significant privilege escalation of capability that can alter the host and surprise users who expect read-only behavior.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script downloads and executes remote bootstrap code (get-pip.py) and also globally disables TLS certificate verification elsewhere in the file. This combination creates a severe supply-chain risk: an attacker able to intercept or tamper with traffic could deliver arbitrary code that the script executes on the host.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The credential check transmits cloud credentials to live IAM services without a clear privacy warning or just-in-time consent. In this skill's context, users may not expect identity-related API calls during setup for a purportedly read-only network query tool.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkeip>=3.1.0 huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkcore>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkeip>=3.1.0 huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkeip>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkeip>=3.1.0 huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkelb>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkeip>=3.1.0 huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0 huaweicloudsdkvpn>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkiam>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkeip>=3.1.0 huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0 huaweicloudsdkvpn>=3.1.0 huaweicloudsdkdns>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdknat>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkelb>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0 huaweicloudsdkvpn>=3.1.0 huaweicloudsdkdns>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkvpc>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkiam>=3.1.0 huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0 huaweicloudsdkvpn>=3.1.0 huaweicloudsdkdns>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkvpn>=3.1.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdknat>=3.1.0 huaweicloudsdkvpc>=3.1.0 huaweicloudsdkvpn>=3.1.0 huaweicloudsdkdns>=3.1.0
Confidence: 92% confidence
Finding: huaweicloudsdkdns>=3.1.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal