huawei-cloud-iam-query

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:59 PM UTC
• Version: 1.0.0

Overview

This IAM query skill is mostly read-only, but it handles cloud credentials while disabling TLS verification and running automatic setup code, so it needs Review before use.

Review this carefully before installing. Use only least-privileged read-only Huawei Cloud credentials, avoid running it on networks or proxy settings you do not fully trust, and prefer waiting for a version that enables TLS verification, pins dependencies, and separates setup from query execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares itself as a read-only IAM query tool but instructs execution of shell commands, reads environment credentials, uses network access, and performs package/environment setup without any declared permission boundaries. This creates an opaque trust boundary where a user may invoke code with access to secrets and the network without an explicit capability declaration, increasing the chance of credential exposure or unexpected command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior materially exceeds the manifest's claimed IAM-only, read-only scope by creating virtual environments, installing software, downloading bootstrap code from the internet, and reportedly disabling SSL verification. These hidden side effects significantly increase supply-chain and remote code execution risk, and the SSL-bypass aspect can enable man-in-the-middle attacks against dependency or API traffic.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill content describes a generic cross-service Huawei Cloud resource query capability rather than a narrowly scoped IAM query skill. This scope confusion can cause operators to invoke a broader set of scripts and APIs than intended, weakening least privilege expectations and obscuring what data or services the skill may touch.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The title and overview present the skill as a general Huawei Cloud resource query tool, contradicting the IAM-specific manifest. Misleading framing is dangerous in a security-sensitive skill because users may grant trust or provide credentials under the assumption of narrower behavior than the documentation actually encourages.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The capability, workflow, and parameter sections describe broad non-IAM querying patterns, including generic resource, image, disk, and dependency discovery workflows. In context, that broadens data-access expectations and can normalize use of credentials for unrelated services, which is risky for a skill advertised as an IAM-only read-only helper.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The code explicitly sets `ignore_ssl_verification = True` and suppresses the related warning, which disables certificate validation for IAM API traffic. Even though the skill is described as read-only, it handles highly sensitive AK/SK credentials and IAM responses, so a man-in-the-middle attacker could intercept credentials, security tokens, and policy data or tamper with returned results.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill automatically honors `HTTPS_PROXY`/`HTTP_PROXY` and also accepts proxy credentials, allowing IAM traffic and authentication material to be routed through an arbitrary environment-controlled intermediary. Combined with disabled TLS verification, this creates a strong exfiltration and interception path for AK/SK, security tokens, and sensitive identity metadata; even without that, undisclosed proxying of IAM queries materially expands the trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This helper automatically creates a virtual environment and re-executes itself, which exceeds the declared read-only IAM query purpose of the skill. In an agent context, environment mutation broadens the trust boundary and can be abused to alter the host runtime unexpectedly even though the skill is supposed to be query-only.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script runs local package-manager and system-preparation commands such as apt, yum, dnf, winget, and brew, including privileged installation flows unrelated to IAM querying. In an agent skill advertised as read-only cloud inspection, executing host-modifying commands is a dangerous scope expansion that can change the machine state or trigger privileged prompts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script downloads external bootstrap code (get-pip.py) and executes it locally, which is a classic supply-chain and remote-code-execution risk. This is especially unjustified for a read-only IAM query skill, and the risk is worsened by the script's disabled TLS verification elsewhere, undermining transport trust.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs system and Python package installation actions without an explicit confirmation prompt. In an agent-executed setting, silent environment modification violates least surprise and can lead to unwanted software changes or escalation workflows on the host.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script prints a broad set of IAM user attributes directly to stdout, including personally identifiable information and security-relevant fields such as email, phone, password status, last login time, password authentication time, and account ownership indicators. In an agent or automation context, stdout is often logged, forwarded, or exposed to downstream tools, so this creates unnecessary disclosure risk even though the API call itself is read-only.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# ── 工具函数 ──────────────────────────────────────────────────────────

def run_cmd(cmd, timeout=None, **kwargs):
    """运行命令，返回 (returncode, stdout, stderr)

    Args:

• Confidence: 74% confidence
• Finding: The helper defaults to no timeout for subprocess execution, which can permit indefinite hangs when commands block on network, package managers, or interactive prompts. In an automated agent environment, this can be abused or accidentally triggered to cause denial of service and tie up worker capacity.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a minimum version only, which allows future unreviewed versions to be installed. This can introduce supply-chain risk through breaking changes or newly introduced vulnerable releases, especially in a security-sensitive IAM querying skill that handles identity-related SDK interactions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

huaweicloudsdkcore>=3.1.0
huaweicloudsdkiam>=3.1.0

• Confidence: 92% confidence
• Finding: The IAM SDK dependency is also unpinned, so installs may resolve to newer versions that have not been tested or security-reviewed for this skill. Because this package is used to query identity and access management data, unexpected dependency changes could affect reliability or expose the skill to supply-chain compromise if a bad release is published.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/ensure_env.py:284