huawei-cloud-icp-rule-consult

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a read-only Huawei Cloud ICP consultation helper, but its bundled web tools are broader than that purpose because they can fetch or browse arbitrary sites.

Review before installing in sensitive environments. It is not designed to change accounts or submit filings, but its scripts should ideally be restricted to Huawei Cloud ICP documentation domains and prevented from reaching localhost, private networks, or untrusted remote Chrome endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit permissions, yet its documented operation depends on environment access and outbound network activity. This creates a governance gap: operators and policy engines cannot accurately assess or constrain what the skill can do, increasing the chance of unintended data exposure or unauthorized external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a narrow, read-only ICP consultation tool, but its documented behavior includes arbitrary URL fetching, raw HTML retrieval, link extraction, free-form site search, and arbitrary CSS-selector scraping. That mismatch expands the effective attack surface far beyond the stated purpose and can be abused for unintended web access, content retrieval, or data harvesting under the guise of a constrained support skill.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file exposes a generic URL-fetching tool that can retrieve HTML, extract text, or enumerate links from arbitrary user-supplied URLs, which is broader than the stated ICP备案 consultation purpose. In an agent setting, this creates a server-side request capability that could be repurposed to access unintended internal services, fetch sensitive intranet resources, or bypass product scope restrictions if callers are not tightly constrained elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The link extraction routine walks all anchor tags from any supplied URL and returns up to 200 resolved links, enabling arbitrary site mapping unrelated to ICP consultation. While not destructive by itself, this expands the tool into a reconnaissance primitive that can help enumerate internal web apps, sensitive endpoints, or unintended external content when combined with agent access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The search interface is a generic website automation/search utility rather than a narrowly scoped ICP-rule consultation component. Because it accepts arbitrary keywords and can browse/search live sites, it materially exceeds the declared read-only ICP consultation scope and can be repurposed for unrelated data retrieval or browsing tasks, undermining least-privilege boundaries for the skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The `site` parameter allows callers to direct Playwright-driven browsing to arbitrary domains instead of restricting access to Huawei Cloud ICP documentation. In a skill advertised as narrow consultation-only, this creates unnecessary external reach and a path for misuse, SSRF-like internal targeting if environment/network placement permits, or policy bypass through arbitrary browsing.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger set for filing_process includes short, generic phrases such as '备案材料', '前置审批', '审核时长', and especially '通信地址' and '首页URL', which can appear in broader compliance, website setup, or form-filling contexts. In a semantic router, overly broad triggers can misroute unrelated user requests into this skill, causing incorrect policy guidance, scope bypass, or unintended disclosure of filing-specific advice outside the intended context.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The access_filing trigger list contains ambiguous short phrases like '过白', '加白', and vendor names alone, which may match unrelated networking, security allowlisting, or competitive cloud-support questions. Because this catalog is meant to route user intent, such ambiguity increases the chance of false activation and misclassification into access-filing workflows.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Triggers such as '一个账号', '多个主体', 'IAM备案权限', and '账号实名' are broad enough to overlap with routine account administration, IAM, or identity-verification questions that are not about ICP filing. This can cause the skill to capture ordinary account-management requests despite the stated boundary that it should only handle filing consultation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Terms like '公钥', '签名MD5', and even '鸿蒙备案' include highly generic technical vocabulary that may be used in app signing, security, or mobile release discussions unrelated to filing. In a trigger-based router, this can divert technical support or cryptography questions into a regulatory consultation skill, leading to incorrect answers and boundary violations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When `REMOTE_CHROME_HOST` is set, the module connects to a remote Chrome debugging endpoint and routes browsing activity through that host without any explicit user-facing disclosure or trust validation. This can expose user queries, visited URLs, session behavior, and page contents to an external system, which is especially risky for consultation tools handling potentially sensitive regulatory/business questions.

Known Vulnerable Dependency: requests==2.32 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: requests==2.32

Known Vulnerable Dependency: aiohttp==3.9.5 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: aiohttp==3.9.5

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.