huawei-cloud-functiongraph-function-create

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:42 PM UTC
• Version: 1.0.0

Overview

This skill appears intended to deploy Huawei Cloud functions, but it asks users toward broad cloud and IAM authority without enough scoping or warnings.

Review before installing. Use only a least-privilege Huawei IAM user in a test project, confirm the region/project/function name/code before any run, avoid wildcard or IAM-admin policy steps unless an administrator explicitly approves them, and do not use this with production credentials or sensitive source code unless you intend to upload it to Huawei Cloud.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill instructs use of environment-based Huawei Cloud credentials and local script execution, which implies access to sensitive environment variables and local files, but it declares no corresponding permissions. This creates a transparency and control gap: an agent may invoke the skill with capabilities the user did not explicitly approve, increasing the risk of unintended credential access or reading local files during deployment workflows.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is scoped to creating FunctionGraph functions, but the IAM reference explicitly includes broader lifecycle and destructive permissions such as update and delete. In an agent context, documenting these as 'required' can normalize over-privileged access and lead operators to grant capabilities that exceed the stated task, increasing blast radius if the agent is misused or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Including instructions to create IAM policies and attach them to users expands this skill from function deployment into IAM administration, which is a materially more sensitive capability. In practice, this can enable privilege expansion by guiding an agent or user to mint access rather than merely consume pre-existing permissions, undermining separation of duties.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The cross-service permissions section introduces additional service capabilities such as OBS, VPC, DIS, APIG, and LTS, including an example with broad wildcard FunctionGraph access. While operationally relevant, bundling these into a function-creation skill increases the chance that users grant excessive multi-service access beyond immediate need, enlarging attack surface and lateral movement options.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The verification and troubleshooting guidance includes IAM-administrative discovery actions such as listing attached policies, showing user information, and listing policy attachments. Although useful for diagnostics, these steps go beyond function creation and can encourage unnecessary identity reconnaissance within an agent workflow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The verification guide includes commands that create API Gateway triggers and therefore performs state-changing operations beyond simple verification of function creation. In a skill whose declared purpose is creating/deploying functions, embedding additional infrastructure creation in a verification document can cause unintended resource changes, broaden privilege use, and increase the chance of accidental production impact.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document instructs updating environment variables to enable debug logging, which is a configuration mutation unrelated to narrow create-only verification. This can alter runtime behavior, expose sensitive data through verbose logs, and create persistence of insecure debug settings if copied into production workflows.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases include generic terms such as 'create function', 'deploy function', and 'upload function', which are broad enough to match unrelated contexts outside Huawei Cloud FunctionGraph. This can cause accidental activation of a cloud-modifying skill, leading to unintended infrastructure changes, execution of deployment actions in the wrong environment, or surprise resource creation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This skill performs creation of cloud functions, which directly modifies infrastructure and can incur usage charges, but the description does not prominently warn users about these side effects. In a cloud deployment context, omission of that warning is dangerous because users may trigger persistent resource creation without understanding cost, permission, or production-impact consequences.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The guide tells users to run credential-checking and debug-related commands without warning that outputs may reveal access key configuration details or increase sensitive log exposure. In an agent skill context, omission of safety notes can lead users to run commands in shared terminals, CI logs, or production environments where secrets and internal state may be exposed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document includes live invocation and trigger-creation commands but does not warn that these actions modify cloud resources, may hit production code paths, and can incur charges. In a deployment skill, users may reasonably trust verification steps as safe, making the lack of disclosure more dangerous and increasing risk of accidental side effects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This tool transmits user-supplied function code to Huawei Cloud to create a remote serverless function, but it provides no explicit confirmation or warning that code content will be uploaded off-host. In an agent/skill context, that omission matters because users may supply sensitive source code, secrets, or proprietary logic without realizing it will be sent to a third-party cloud API.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.