huawei-cloud-flexus-l-server-manage

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:42 PM UTC
• Version: 1.0.0

Overview

This skill is for legitimate Huawei Cloud server lifecycle management, but it handles billable/destructive cloud actions while using unsafe TLS settings and under-disclosing some created resources and payment defaults.

Review carefully before installing. Use only least-privilege temporary Huawei credentials, run dry-run first, verify region, resource IDs, auto-pay, auto-renew, and any EVS/CBR/HSS components before confirming, and avoid using this on untrusted networks unless TLS verification is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes and encourages use of shell execution, environment variables for credentials, and outbound network access to Huawei Cloud APIs, but it does not declare permissions or capability boundaries in a machine-enforceable way. This creates a transparency and policy-enforcement gap: an agent may invoke a high-impact skill with access to secrets and external services without the platform or user having explicit permission visibility.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The create flow silently provisions additional paid resources (EVS, CBR, HSS) beyond the manifest's stated lifecycle-management purpose, which can cause unexpected charges and broaden the deployed attack surface. In an agent skill context, hidden side effects are especially risky because users may believe they are purchasing only a lightweight server instance.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The top-level activation phrases include broad terms like "purchase server," "renew," and "unsubscribe," which can match unrelated user intents and trigger a skill capable of billing, provisioning, and cancellation actions. In a skill that can create or terminate paid cloud resources, unintended activation materially increases the risk of destructive or costly actions being proposed or executed in the wrong context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger rules section repeats ambiguous phrases such as "Purchase Huawei Cloud server," "Huawei Cloud renewal," and "cancel subscription flexus" without sufficiently strict scope checks. Because this skill handles real account operations with billing and lifecycle impact, broad matching can misroute conversations and increase the chance of accidental renewals, unsubscribes, or purchase workflows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The reference documents server creation, renewal, and unsubscription endpoints, including auto-pay and auto-renew parameters, but provides no warning that these actions can incur charges or irreversibly affect running resources. In an agent skill context, this omission increases the risk that an LLM or user triggers costly or destructive operations without clear confirmation or understanding of the consequences.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The troubleshooting guide instructs users to pass AK/SK credentials directly on the command line, which can expose secrets through shell history, process listings, logs, and screenshots. In a cloud-management skill with billing and lifecycle operations, compromised AK/SK could allow unauthorized resource creation, renewal, deletion, or broader account access depending on IAM scope.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The dependency specification allows installation of requests versions at or above 2.31.0 without an upper bound or a patched minimum tied to the cited advisories. If dependency resolution selects a vulnerable release, network operations in this cloud-management skill could expose credentials, mishandle TLS/session verification, or leak sensitive data during API calls to Huawei Cloud or attacker-controlled endpoints.

Known Vulnerable Dependency: pyasn1 — 6 advisory(ies): CVE-2026-23490 (pyasn1 has a DoS vulnerability in decoder); CVE-2026-59885 (pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing al); CVE-2026-59886 (pyasn1: Uncontrolled resource consumption when converting decoded REAL values) +3 more

High

• Category: Supply Chain
• Confidence: 79% confidence
• Finding: The pyasn1 dependency is declared with only a lower bound, so vulnerable future or currently affected versions may be selected. ASN.1 parsing flaws commonly enable denial of service via maliciously crafted inputs, which is relevant if SDKs or supporting libraries process certificates, signatures, or encoded protocol data from remote services.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: PyYAML has a history of unsafe deserialization issues, and the dependency is specified broadly enough that vulnerable versions may be installed. In an automation skill that may read configuration or user-supplied data, unsafe YAML parsing could lead to code execution or other unsafe object construction if the library is used insecurely elsewhere in the project.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

full_url,
            headers=signed_request.header_params,
            data=signed_request.body,
            verify=False,
            timeout=60
        )

• Confidence: 99% confidence
• Finding: Disabling TLS certificate verification allows man-in-the-middle interception or modification of authenticated API traffic, including signed cloud management requests and responses. In a skill that creates, renews, and unsubscribes paid cloud resources, this can enable tampering, credential/token exposure, or fraudulent resource actions on hostile networks.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/flexus_lifecycle.py:466