Security audit

huawei-cloud-business-tf-support

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly read-only, but its billing-only description does not match its broader cloud inventory scripts and automatic setup behavior.

Review this before installing. Use only tightly scoped Huawei Cloud credentials, preferably temporary and read-only for billing where possible. Expect local dependency installation and outbound Huawei Cloud API calls, and do not rely on this as a billing-only skill unless the publisher removes or clearly separates the resource inventory and automatic setup behavior.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (52)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions while its documentation instructs the agent to execute shell commands, access environment variables containing cloud credentials, and make network calls to Huawei Cloud APIs. This hidden capability expansion is dangerous because callers may trust the billing-only framing while the skill can enumerate broader account metadata and perform environment setup actions such as dependency installation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior materially exceeds the stated purpose of a Terraform billing/pricing support skill by describing a generic Huawei Cloud resource query framework, IAM project lookups, service availability checks, and environment provisioning. A description-behavior mismatch undermines trust boundaries and can cause an agent or operator to invoke the skill in situations where they expect only narrow billing access, but instead expose broader inventory and credential-validation functionality.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The body of the skill describes a broad Huawei Cloud resource inventory and query tool rather than a narrowly scoped billing support skill. In security terms, this expands reachable data domains beyond what a user or orchestrator would reasonably authorize, increasing the chance of unintended cloud reconnaissance and metadata exposure.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Claiming the ability to query arbitrary Huawei Cloud resources and environment inventory is unjustified for a Terraform billing/pricing helper and creates a pathway for excessive data collection. Even if nominally read-only, broad inventory access can reveal architecture, resource identifiers, regions, project structure, and operational state that are sensitive and useful for lateral reconnaissance.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The manifest and inline documentation contradict each other: one frames the skill as billing-only while the other instructs use as a generic resource-query engine. This inconsistency is dangerous because security reviewers, orchestrators, or users may rely on the safer description while the actual documented behavior authorizes broader execution and data access.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This script enumerates bare metal server flavor details such as IDs, names, vCPU, RAM, disk, CPU architecture, and availability-zone-scoped options, which is outside the declared billing/pricing-only purpose of the skill. In a billing-only Terraform support context, adding infrastructure inventory/spec discovery expands the skill's effective permissions and information-access scope, enabling unauthorized reconnaissance of available compute configurations.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The code builds and executes a BMS API request that returns detailed resource-spec information and then provides sorting, filtering, and pagination-like traversal for operator-friendly infrastructure discovery. That capability is unjustified for a skill advertised as handling billing and pricing inquiries only, and it increases the risk of misuse for cloud environment reconnaissance beyond the user's expected scope.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script claims to support Huawei Cloud billing/pricing inquiries, but it never calls a Huawei pricing or billing API and instead returns hard-coded estimates. In a Terraform support skill, this can mislead users into making cost-sensitive infrastructure decisions based on inaccurate or stale data, especially because the output is formatted like an authoritative pricing table.

Intent-Code Divergence

Low

Confidence: 85% confidence
Finding: The CLI requires project_id and advertises region/project-specific inquiry behavior, but project_id and engine are not actually used in pricing logic. This creates a misleading interface that may cause operators or calling agents to trust that the result is scoped to their environment when it is not.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This script exposes a measure-unit conversion metadata query that is outside the manifest’s declared Terraform billing/pricing inquiry scope. Scope drift is dangerous because it expands the agent’s callable surface beyond user expectations and policy boundaries, increasing the chance of unintended data access or misuse even if the API itself is read-only.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The implemented behavior queries conversion metadata rather than billing or price inquiry results, which conflicts with the skill’s stated billing-only purpose. This mismatch weakens trust and enforcement around least privilege, because downstream systems may authorize or invoke functionality they would not expect from the manifest.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script exposes functionality to query geographic county metadata, which falls outside the declared billing and pricing scope of the skill. In an agent setting, scope drift is dangerous because it expands accessible capabilities beyond user and policy expectations, undermining least privilege and making misuse or hidden data-enumeration behavior harder to detect.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Administrative geography lookup is not justified by the skill's stated billing-support purpose, indicating unnecessary capability inclusion. Even if the queried data is not highly sensitive, undocumented extra functionality increases attack surface and can be abused for unauthorized enumeration or as a stepping stone for broader policy evasion within the agent.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file's description and CLI help clearly present it as a county-list query, contradicting the manifest's billing-only intent. This mismatch is dangerous because users, reviewers, and enforcement systems may trust the manifest while the implementation quietly provides unrelated capabilities, enabling deceptive packaging and weakened governance.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script exposes parameters such as customer_id, indirect_partner_id, and method=sub_customer, which enable querying customer and reseller/enterprise order data beyond a narrow Terraform billing-price inquiry use case. In a credentialed agent context, this expands accessible business data and can enable overbroad collection of account-specific order information if the skill is invoked with attacker-influenced inputs.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script explicitly supports `method=sub_customer` with `sub_customer_id`, enabling retrieval of enterprise sub-account billing data rather than being limited to the caller's own billing view. In a billing-support skill, this broadens access to potentially sensitive financial information and creates an authorization/scope mismatch if upstream controls do not strictly restrict which tenant or operator may invoke it.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The output includes highly granular consumption and billing fields such as customer IDs, payer account IDs, resource instance IDs, order/trade IDs, tags, and account names. For a skill described as handling billing/pricing inquiries, returning raw detailed records instead of least-privilege summaries increases exposure of sensitive operational and financial metadata that could be misused for reconnaissance or privacy violations.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script's behavior does not match the declared skill scope: instead of billing, balance, order, refund, usage, or pricing data, it retrieves province metadata. In an agent skill, this scope mismatch is dangerous because it expands remote API capability beyond what the user and manifest describe, undermining least privilege and making deceptive or unintended data access harder to detect.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script exposes a generic service-resource enumeration API that falls outside the declared billing/fee-only scope of the skill. In an agent setting, this broadens accessible cloud metadata beyond user-expected billing queries, enabling unintended discovery of service/resource taxonomy that could aid reconnaissance or violate least-privilege assumptions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script enumerates ECS flavors, availability-zone-scoped capacity options, and supports broad client-side filtering/sorting, which is outside a skill declared as billing/pricing-only support. Even without write operations, it expands the skill into infrastructure discovery, enabling users or downstream agents to inventory compute capabilities and regions in ways the manifest does not justify.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code performs large-scale flavor collection with pagination and local filtering, which gives an agent broad resource-capacity discovery capability unrelated to billing support. In the context of a billing skill, this mismatch is more dangerous because it can be invoked under a trusted financial pretext while exposing operational infrastructure metadata useful for reconnaissance.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This script enumerates ELB service flavors and related service metadata, which is outside the declared skill scope of billing, fee, and pricing support only. Even though it performs no write actions, exposing infrastructure catalog/enumeration capability broadens the agent's reachable surface area and can disclose environment-relevant cloud service details that are unnecessary for the stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The request and response handling support catalog enumeration of ELB flavors using multiple filters and pagination, enabling broad discovery of available service offerings unrelated to the declared Terraform billing-support purpose. In an agent context, this kind of overbroad read capability is dangerous because it can be repurposed for reconnaissance and violates least privilege and least functionality expectations for a billing-only skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is declared as read-only billing/pricing support, but this script creates a virtual environment and re-executes itself to prepare the host runtime. That host modification is out of scope for a billing-query skill and increases the blast radius from passive querying to local environment alteration, which is especially risky in an agent setting where users may not expect setup scripts to mutate their system.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This code can install packages via pip and, elsewhere in the file, invoke OS package managers despite the manifest advertising a billing-only read-only capability. In an agent skill, that mismatch is dangerous because it grants local software installation capability unrelated to the business purpose, creating supply-chain and host-integrity risk if triggered automatically.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284