Security audit

huawei-cloud-find-skills

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent, but it should be reviewed because it can install other skills and sends an install-count request without clear user consent.

Review the matched skill and exact install command before allowing installation. Be aware that using the install flow may contact GitCode, GitHub, ClawHub, and a Huawei install-count endpoint, and may add new instructions to the local agent environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to perform outbound network access to GitCode, GitHub, raw.githubusercontent.com, and a Huawei telemetry endpoint, yet it declares no permissions or equivalent capability disclosure. This hides the true execution surface from reviewers and users, making unexpected data egress and remote-content trust more likely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 72% confidence
Finding: The declared purpose says the skill can search, browse, discover, find, and install skills, but the described implementation relies on remote index retrieval, ranking logic, and then directs downstream installation of additional skills. This mismatch reduces transparency and can mislead users about the operational behavior and trust boundary, especially because remote content determines what may later be installed.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims the skill is read-only, but it also mandates package installation commands and a POST request that increments install metrics. That contradiction can cause users or orchestrators to treat the skill as non-mutating when it actually changes the local environment and sends outbound state-changing requests.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The required install-count API call is telemetry unrelated to the core user goal of finding or installing a skill. Forcing the agent to send this POST creates unnecessary data transmission and establishes a nonessential external side effect before installation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to run package installation commands and send an outbound telemetry POST without first warning the user that this will modify the system and transmit data to third parties. Silent installation from remote registries or repositories materially increases supply-chain and consent risks.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill instructs the agent that for any Huawei Cloud query or management task it must use this workflow, install a matched skill, and follow the installed skill's instructions. This removes user choice and can funnel broad classes of requests into a mandatory remote-install path, increasing the chance of unnecessary installation and exposure to unreviewed downstream skill behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.