huawei-cloud-computing-query

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:50 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a Huawei Cloud query tool, but it also exposes server passwords and console login URLs and performs local setup changes with insufficient user controls.

Install only if you are comfortable granting this skill Huawei Cloud AK/SK access and allowing it to retrieve sensitive server passwords or console login URLs. Use least-privilege credentials, avoid running password or console scripts unless explicitly needed, keep outputs out of logs/transcripts, and review the setup path before allowing package installation or .project_id persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions, yet its instructions explicitly require shell execution, network access, environment variable use, and local file writes during environment bootstrapping. This is dangerous because a caller may treat the skill as low-risk/read-only while it can install dependencies, contact external services, and persist data locally, expanding the attack surface and enabling unintended code execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is advertised as a read-only query tool, but the documented/observed behavior includes retrieving server passwords, performing dependency installation, validating credentials against IAM, and writing an auto-discovered project ID to disk. In context, this makes the skill materially more dangerous because operators may authorize it expecting harmless inventory queries, while it can access secrets and modify the local environment, creating both credential-exposure and trust-boundary risks.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script calls the Huawei BMS API to retrieve a Windows bare metal server password and prints it directly to stdout. Exposing privileged credentials is highly sensitive and exceeds the skill's stated purpose of read-only infrastructure querying, creating a clear risk of credential disclosure through logs, terminals, transcripts, or downstream tooling.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: Although these lines define CLI arguments, they support a workflow whose purpose is to retrieve a server password, which is a sensitive credential unrelated to ordinary inventory browsing. In the context of this skill, the ability to supply project and server identifiers for password extraction materially enables secret access that the manifest does not justify.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This script performs a highly sensitive secret-retrieval action by calling the ECS API to obtain a server password and then exposing it to the caller, which exceeds the skill's declared read-only resource-query purpose. In the context of a cloud inventory/query skill, retrieving instance credentials materially increases abuse potential because anyone able to invoke the skill could obtain access secrets rather than just metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code retrieves a server password and treats it as normal query output, directly exposing a credential that can enable interactive compromise of the ECS instance. This is not justified by the stated use case of listing or viewing compute resources, so the mismatch between declared functionality and actual behavior makes the skill more dangerous, not less.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as query-only, but this helper creates a virtual environment, re-executes itself, and later participates in package installation and metadata persistence. That mismatch expands the skill's operational scope and makes it more dangerous because users invoking a read-only cloud query capability may not expect local environment mutation and execution flow changes.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This script can invoke system package managers (`apt`, `yum`, `dnf`, `brew`, `winget`) and attempt software installation, which is far beyond the stated purpose of querying Huawei Cloud resources. In skill context this is especially risky because it introduces privileged local system changes, supply-chain exposure, and unexpected host impact in a tool users would reasonably assume to be non-invasive.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script downloads `get-pip.py` from external sources and executes it locally, while global TLS verification has been disabled elsewhere in the file. This creates a severe remote code execution and supply-chain risk, especially inappropriate for a query-only skill, because a network attacker or compromised mirror could deliver arbitrary Python code to be executed on the host.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring claims the script validates environment and API availability, but the implementation also creates virtual environments, installs packages, may install Python itself, and writes project metadata files. This deceptive or incomplete disclosure increases security risk because operators cannot make informed trust decisions about a skill advertised as a harmless checker.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide explicitly documents a capability to retrieve a Windows bare metal server's initial password, which is sensitive credential material, but provides no warning, access-control expectations, or handling guidance. In a cloud infrastructure query skill, exposing or normalizing credential retrieval increases the chance that operators or downstream agents will fetch, display, log, or mishandle secrets, enabling unauthorized access if outputs are leaked.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly documents a script to retrieve a server password without any warning, approval requirement, or sensitivity notice. In a query-oriented skill advertised as 'no write operations,' exposing credential-retrieval capability can still enable unauthorized access and materially expands the skill's effective privilege surface.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The remote console entry exposes a path to privileged interactive system access but is presented as a routine query action with no cautionary language. Even though it is read-oriented documentation, obtaining a VNC remote login address can facilitate direct administrative access to instances and bypass normal operational boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Serial console access is a highly sensitive administrative capability, especially for recovery and low-level system interaction, yet the guide lists it without any warning or restriction guidance. In the context of a cloud query skill, this makes the skill more dangerous because it normalizes access beyond passive inspection into potentially powerful console entry points.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script prints the remote console URL directly to stdout, and such URLs commonly grant immediate or time-limited administrative console access to the bare metal server. If stdout is exposed through agent logs, shared terminals, chat transcripts, or downstream tooling, this can leak a sensitive access token and enable unauthorized server access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script outputs the Windows bare metal server password without any warning, masking, consent checkpoint, or safeguards. This makes accidental disclosure likely in shell history, CI logs, agent transcripts, or shared terminal sessions, turning a sensitive cloud secret into broadly accessible plaintext.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Printing the retrieved password directly to stdout creates immediate disclosure risk through terminal history, orchestration logs, agent transcripts, and downstream tooling that captures command output. Even if password retrieval were authorized, emitting it without masking, warning, or secure handling is unsafe and can leak credentials beyond the intended recipient.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Writing `.project_id` into the project directory without prior notice or confirmation is an unexpected side effect and may leak environment-specific cloud metadata into the workspace. While the impact is limited, it violates the principle of least surprise and can create persistence or disclosure issues in shared repositories or automated environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only, so installations may resolve to different newer versions over time. That creates supply-chain and reproducibility risk: a future compromised or breaking upstream release could be pulled into the skill without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0
huaweicloudsdkbms>=3.1.0

• Confidence: 96% confidence
• Finding: Using an unpinned minimum version allows package resolution to drift to any later release, including versions not tested with this skill. If an upstream package release is malicious, vulnerable, or incompatible, the environment may silently ingest it.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkas>=3.1.0

• Confidence: 96% confidence
• Finding: The IAM SDK dependency is not pinned, so builds are not reproducible and may consume unexpected future releases. This weakens supply-chain control and can expose the skill to newly introduced malicious code or vulnerable transitive dependencies.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkecs>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkas>=3.1.0

• Confidence: 96% confidence
• Finding: A '>=' requirement for the IMS SDK permits uncontrolled upgrades at install time. That increases the chance of supply-chain compromise or operational breakage from an unreviewed upstream release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkecs>=3.1.0
huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkas>=3.1.0

• Confidence: 96% confidence
• Finding: The BMS SDK is unpinned, meaning any later version satisfying the minimum may be installed. This is a classic low-severity supply-chain hygiene issue because it broadens the trust boundary to future releases that have not been validated.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkiam>=3.1.0
huaweicloudsdkims>=3.1.0
huaweicloudsdkbms>=3.1.0
huaweicloudsdkas>=3.1.0

• Confidence: 96% confidence
• Finding: The auto-scaling SDK dependency is declared with only a lower bound, so deployments may pick up arbitrary newer versions. That can introduce vulnerable or malicious upstream code and makes incident reproduction and rollback harder.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284