Back to skill

Security audit

huawei-cloud-business-support-query

Security checks for vulnerabilities and agentic risk

Overview

This looks read-only, but it asks for broad Huawei Cloud credentials and local setup execution while its billing-focused description does not fully match the broader resource and identity queries present in the artifact.

Install only if you intend to grant the skill read-only Huawei Cloud billing plus related inventory/identity lookup ability and allow it to run local Python setup. Use temporary least-privilege credentials, review the scripts before first use, expect sensitive billing identifiers and amounts to appear in command output/logs, and avoid using broad admin AK/SK values.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly instructs execution of local shell commands, uses environment variables containing cloud credentials, and performs networked queries, yet no permissions are declared. This creates a transparency and policy-enforcement gap: a host may permit the skill under the assumption it is low-risk billing-only logic while it can actually execute code, access secrets indirectly, and contact external cloud APIs.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest markets the skill as a billing/pricing query tool, but the documentation reveals broader infrastructure discovery capabilities and bootstrap checks that validate credentials and call IAM/ECS APIs. This mismatch can mislead users and platform controls into granting or invoking a much more powerful skill than expected, increasing the risk of unintended cloud inventory exposure.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The body of the skill describes a generic Huawei Cloud resource query and inventory capability rather than the narrow billing/pricing role stated in metadata. Such scope inflation is dangerous because operators may invoke or approve the skill expecting access only to financial data, while it can enumerate broader cloud resources and identifiers.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The documented capability scope expands into generic infrastructure discovery, individual resource detail retrieval, and dependency mapping, which goes well beyond billing support. In a cloud environment, this materially increases the sensitivity of obtainable data and can aid reconnaissance even if no write actions are exposed.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill requires running environment-check scripts that install dependencies and validate credentials/service availability before use. For an advertised read-only billing/pricing skill, automatic bootstrap and credential-validation steps expand the execution surface and can trigger network/API activity beyond user expectations.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The title and overview present the artifact as a general Huawei Cloud resource query skill, directly contradicting the billing/pricing identity in the manifest. This inconsistency is risky because trust decisions are often based on metadata; misleading identity can conceal broader cloud-enumeration behavior under a benign business-support label.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This script adds ECS flavor enumeration to a skill whose declared scope is Huawei Cloud billing, pricing, balances, coupons, orders, and consumption stats. Even though it is read-only, it broadens the skill into infrastructure inventory access, which violates least privilege and can expose internal deployment preferences, available compute SKUs, and project/region metadata beyond the user’s expected billing context.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code imports and uses ECS SDK clients and region modules that are unrelated to the stated business-support billing/pricing function. This unjustified cross-service access increases the attack surface and can enable unauthorized cloud resource enumeration if the skill is invoked in contexts where users or operators only expect financial data access.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This helper creates a virtual environment and re-executes the script, introducing local state changes and process-control behavior that exceed the skill's declared read-only billing/pricing scope. In an agent-skill context, hidden environment mutation increases trust and supply-chain risk because a user invoking a query capability would not reasonably expect local setup automation with execution handoff.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script installs software via pip and may fetch bootstrap/install artifacts over the network, which is materially beyond a no-write billing/pricing query function. In this skill context, package installation expands the attack surface to dependency confusion, malicious mirror content, and unauthorized host modification, making the mismatch between declared and actual behavior security-significant.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
This code provides a reusable subprocess execution primitive that is then used to run package managers and other local commands unrelated to billing queries. Within a read-only cloud-cost skill, local command execution is unnecessarily powerful and can be abused by future modifications or compromised inputs to alter the host, install tooling, or extend behavior beyond the manifest.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Credential validation works by listing IAM users, which introduces identity-enumeration capability unrelated to billing, pricing, or cost queries. In this context the extra permission scope is unnecessary and increases privacy and blast-radius concerns if credentials are overprivileged or the output is exposed.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This script enumerates IAM projects by region, which goes beyond the skill's declared billing/pricing support scope. Even though the operation is read-only, it exposes account structure metadata and can be used as a capability-enabling step for broader cloud reconnaissance, especially when combined with valid credentials.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code uses IAM credentials to access account metadata without that access being clearly justified by the stated billing/pricing purpose. This expands the effective privilege and data exposure of the skill, making it easier to map tenant resources and account layout if the skill is misused or invoked unexpectedly.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This script performs NAT gateway specification enumeration, which is outside the declared billing/pricing-only scope of the skill. Even though it is read-only, it expands the skill into infrastructure discovery, exposing service inventory and capacity details that users and orchestrators would not reasonably expect from a finance-focused skill. In skill-based agent systems, scope drift is dangerous because it can be abused to access adjacent cloud metadata under the guise of a benign billing tool.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This script queries SFS Turbo filesystem share types, which is unrelated to the skill’s declared billing and pricing scope. Scope drift in an agent skill is dangerous because it expands accessible cloud APIs beyond user expectations and policy review boundaries, enabling unintended infrastructure reconnaissance and increasing the blast radius if the skill is invoked automatically or with broad credentials.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The script automatically loads cloud credentials and performs a billing/account-change query without any user-facing disclosure, consent gate, or indication that sensitive financial/account metadata will be accessed. In an agent skill context, this can expose account balances, transaction history, payment-channel details, and billing identifiers to users who may not realize the action triggers privileged cloud API access.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script retrieves and prints highly sensitive billing and account metadata, including customer IDs, enterprise project IDs, resource instance IDs, payer account IDs, account names, order/trade identifiers, and detailed consumption amounts. In an agent/skill context, emitting this data directly to standard output without redaction, minimization, or an explicit sensitivity warning increases the risk of unintended disclosure to users, logs, transcripts, or downstream tools.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script silently loads cloud credentials and immediately performs a billing/resource-usage API call without any user-facing disclosure, confirmation, or indication that account-scoped data will be queried. In an agent skill context, this can expose sensitive financial and usage metadata to a user who may not realize the action is being performed against real tenant credentials, increasing the risk of unintended data disclosure.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script retrieves detailed customer order data from Huawei Cloud and prints it directly to stdout, including customer IDs, contract IDs, creator usernames, payment timing, and line-item billing details. In agent or automation environments, stdout is often logged, persisted, or shown to broader audiences than intended, so this creates a real risk of sensitive business and customer data disclosure even though the script performs no write operations.

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
# ── 工具函数 ──────────────────────────────────────────────────────────

def run_cmd(cmd, timeout=None, **kwargs):
    """运行命令,返回 (returncode, stdout, stderr)

    Args:
Confidence
80% confidence
Finding
The command runner accepts timeout=None, allowing child processes to run indefinitely when callers omit a timeout. In an agent or automation environment this can hang workers, exhaust concurrency, and create denial-of-service conditions, especially because the helper is used for package-management and bootstrap operations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdkiam>=3.1.0
Confidence
92% confidence
Finding
The dependency is specified with a minimum version only, so future installs may resolve to different newer releases. This weakens build reproducibility and can expose the skill to supply-chain risk if a later package release introduces a vulnerability or breaking behavior.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdknat>=3.1.0
Confidence
92% confidence
Finding
Using an unpinned version range allows pip to install any newer compatible release, which can change over time. That creates a supply-chain exposure and makes builds non-reproducible, increasing the chance of unintentionally pulling a vulnerable or incompatible package.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
Confidence
92% confidence
Finding
This package is not pinned to an exact version, so the resolved dependency may drift between installations. Such drift increases supply-chain risk and operational uncertainty if an upstream release is compromised or introduces insecure changes.

Unpinned Dependencies

Low
Category
Supply Chain
Content
huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkelb>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdknat>=3.1.0
huaweicloudsdksfsturbo>=3.1.0
huaweicloudsdkbss>=3.1.0
Confidence
93% confidence
Finding
The IAM SDK is especially sensitive because authentication and credential handling often flow through it, and an unpinned dependency can silently pull in changed code. If an upstream release were vulnerable or malicious, it could affect identity-related operations and access to billing data.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/ensure_env.py:284