huawei-cloud-functiongraph-trigger-create

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:55 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but it needs review because its cloud-credential setup and troubleshooting guidance can expose secrets or weaken TLS while performing real Huawei Cloud changes.

Install only if you are comfortable giving the agent Huawei Cloud credentials that can create or manage FunctionGraph triggers. Use a least-privilege test account, avoid production functions first, do not echo or paste real secrets into logged terminals, do not disable SSL verification with real credentials, and verify every function URN, trigger ID, schedule update, and delete command before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs users to supply cloud access credentials through environment variables, but the skill declares no corresponding permissions or capability metadata. This creates a governance gap: an agent or platform may allow execution without surfacing that the skill reads sensitive secrets from the environment, increasing the chance of unintended credential exposure or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The guide explicitly recommends setting ignore_ssl_verification = True as a troubleshooting step, which disables TLS certificate validation and enables man-in-the-middle interception of SDK traffic, including cloud API requests authenticated with AK/SK credentials. This is not necessary for the skill’s core purpose of creating scheduled FunctionGraph triggers, so the insecure workaround materially increases risk without sufficient justification.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The verification guide includes active operational steps such as invoking the function and temporarily modifying the trigger schedule, which exceed read-only verification and can change system behavior. In a trigger-creation skill, these actions can cause unintended executions, side effects in downstream systems, or production schedule disruption if copied without safeguards.

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The trigger description contains broad activation phrases such as 'timer', 'cron', and 'periodic task', which can cause the skill to match ordinary scheduling-related requests beyond the user's actual intent. In an agent setting, overbroad routing can lead to unintended cloud-side actions such as creating or configuring triggers in the wrong context, especially because this skill performs infrastructure changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The acceptance-criteria document instructs users to export access key, secret key, region, and project ID as environment variables for testing, but it does not include any warning about secret handling, secure storage, shell history exposure, or avoiding committed/shared transcripts. In a cloud-automation skill, this is materially risky because users may paste real credentials into terminals, logs, CI jobs, or screenshots, increasing the chance of credential leakage and unauthorized cloud access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The cleanup section issues a delete-function-trigger command without an explicit destructive-action warning or guidance to verify the target function URN and trigger ID before execution. In infrastructure automation context, this can cause accidental deletion of production triggers, resulting in missed scheduled executions, operational disruption, or loss of important automation behavior.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation instructs users to place long-lived access keys and secret keys directly into shell environment variables and to echo them back for troubleshooting, but it does not warn about risks such as shell history capture, terminal logging, shared-session exposure, or process/environment leakage on multi-user systems. In a cloud-management skill, these credentials can grant direct control over Huawei Cloud resources, so casual handling guidance increases the chance of credential disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions recommend temporarily changing a trigger to a one-minute schedule for testing without prominently warning that this alters production timing and may cause duplicate runs, excess costs, or unintended business actions. In scheduling contexts, even brief trigger changes can have real operational impact if applied to live functions.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.