huawei-cloud-agentorchard-find-skills

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:44 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed, read-only AI Gallery skill search helper; its main issues are overbroad wording and overstated install language, not hidden or harmful behavior.

Install only if you want a Huawei Cloud AI Gallery search helper that runs a local Python script and contacts the documented public Huawei endpoint. Treat the install/subscribe wording as manual guidance: the skill does not install skills for you, and any subscription happens after you open the returned detail page yourself.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The implemented behavior is largely a read-only skill search/browse utility: it loads up to 200 reviewed skills from a public API, detects broad browse intent, ranks matches by substring hits, and outputs names, descriptions, and detail URLs. This aligns with the discovery/search/browse portion of the description. However, the declared purpose explicitly includes 'install' and 'subscribe' triggers and implies support for installing/subscribing skills, but the code has no capability to install, subscribe, authenticate, or call any write endpoint. It also mentions showing skill categories/market content, while the code does not retrieve structured categories; it only shows a hot list or keyword search results. Therefore the description overstates the actual capabilities in materially important ways.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger list contains very broad phrases such as 'search skill', 'find skill', '有什么skill', and '安装skill', which are likely to match ordinary user requests outside this specific marketplace context. Overbroad activation can cause the wrong skill to run unexpectedly, leading to unintended script execution and network access, and can override safer or more relevant agent behaviors.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to execute a Python script that performs network access to a public API, but the manifest does not declare any explicit tool scope or permissions. This creates a governance and review gap: the agent may be allowed to invoke code and outbound network behavior without transparent least-privilege controls, making unintended or expanded behavior harder to detect and constrain.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill claims the agent 'automatically understands intent and executes searches' from unrestricted natural language, which encourages ambiguous activation and immediate action without clear user confirmation. In context, this is more dangerous because activation leads directly to code execution and outbound requests, so benign conversational text may trigger operational behavior unexpectedly.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire acceptance-criteria document is written in Chinese, and line L19 specifically directs users to try Chinese/English keyword switching, but there is no statement that the skill supports user language preference or that Chinese-only documentation is a justified regional requirement. This can indicate a language/locale policy issue if the skill experience is implicitly constrained to Chinese without opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest explicitly includes install and subscribe intents, but this script only fetches public skill metadata, ranks matches, and prints detail links. There is no code path that performs installation, subscription, or any state-changing operation, so the implemented behavior is materially narrower than the claimed capability.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese, which can amount to a language/locale policy issue when the skill does not provide opt-in or alternatives. The policy allows locale constraints when clearly documented and justified, but this file does not state that the guide is intentionally region- or language-specific.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The flow step "Expand Keywords CN-EN" indicates the skill enforces a specific language/locale behavior in natural language. The file does not mention user opt-in, language selection, or a documented reason that this bilingual constraint is required, which can violate locale-choice policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The document is entirely written in Chinese and all example queries and expected outputs assume Chinese-language usage, such as the search keywords and output strings. Because no opt-in, alternative language guidance, or justification for a Chinese-only locale is provided in the file, this is a natural-language locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The module docstring states the script purpose in Chinese, and the rest of the user-facing argparse description and printed messages are also Chinese-only. This can violate a language/locale policy when a skill forces a specific language without user opt-in or documented regional justification.

Static analysis

No suspicious patterns detected.