Security audit

huawei-cloud-monitoring-query

Security checks across malware telemetry and agentic risk

Overview

This appears to be a read-only Huawei Cloud query skill, but it needs review because it disables HTTPS verification and can fetch and run installer code while using cloud credentials.

Review before installing. Use only least-privilege Huawei Cloud credentials, expect a local .venv and authenticated CES/EPS/IAM read queries, and avoid running this version until TLS verification is enabled and the get-pip download-and-execute fallback is removed or strongly verified. Pinning dependencies and narrowing triggers would also reduce risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no permissions while its documented operation clearly requires shell execution, environment access, and outbound network access using cloud credentials. This undermines least-privilege review and informed consent, because users and policy engines cannot accurately assess what the skill will do before execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest presents the skill as a read-only CES/EPS monitoring query tool, but the documentation describes additional behaviors such as creating a venv, installing or upgrading packages, attempting OS-level package installation, and performing IAM-related operations. This mismatch can bypass user expectations and security controls, and package installation in particular expands the attack surface beyond simple read-only querying.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The overview expands the skill from CES/EPS monitoring into a broad Huawei Cloud resource discovery tool covering specifications, images, disks, and general inventory. In a credentialed cloud environment, undocumented expansion of query scope increases the risk of excessive data access and unintended exposure of infrastructure metadata.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The documented capability scope exceeds the manifest by advertising cross-service resource list, detail, specification, image, and dependency queries rather than CES/EPS-focused monitoring operations. Overbroad capability claims in an executable skill can lead to execution of scripts against more services than users or reviewers authorized.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: Presenting the skill as a generic Huawei Cloud resource query tool contradicts the service-specific manifest and normalizes broader use than intended. This increases the chance of accidental invocation for unrelated cloud discovery tasks and weakens reviewers' ability to reason about scope and data exposure.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code explicitly sets `http_config.ignore_ssl_verification = True`, which disables TLS certificate validation for all Huawei Cloud API requests. This enables man-in-the-middle interception or tampering of monitoring responses and can also expose AK/SK or temporary security tokens sent to cloud endpoints or proxies. In this skill's context, the issue is more dangerous because it handles cloud credentials and enterprise monitoring data, so a read-only purpose does not meaningfully reduce the security risk.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is described as a read-only Huawei monitoring/query tool, but this helper performs host-level package manager operations and dependency installation, including privileged system changes on the user's machine. That broadens the trust boundary far beyond the stated skill purpose and can unexpectedly modify the host environment, which is especially risky for agent-distributed skills.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script downloads get-pip.py from the network and immediately executes it, creating a remote code execution supply-chain path. In a monitoring-query skill, executing externally fetched bootstrap code is unnecessary and dangerous, and the earlier global TLS-verification disablement makes this even more exploitable.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code globally disables HTTPS certificate verification by replacing the default SSL context with an unverified one. This permits man-in-the-middle interception of all subsequent urllib HTTPS requests in the process, including dependency bootstrap and mirror probing, undermining transport security and enabling malicious package/code delivery.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad triggers such as generic English terms like 'alarm', 'monitoring', and 'alert' can cause the skill to activate in loosely related conversations. Because execution uses local scripts and cloud credentials, unintended invocation could trigger unnecessary authenticated queries and expose infrastructure metadata.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The description does not clearly warn users that using the skill causes authenticated network requests with cloud credentials and may install dependencies locally. Without this disclosure, users may unknowingly authorize actions that affect their local environment and query sensitive cloud account metadata.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The guide explicitly notes that EPS uses GlobalCredentials and that a project_id is not required, but it does not warn users that these commands may enumerate account-wide enterprise project and resource metadata beyond a single project scope. In a read-only monitoring/query skill, this is not direct code execution or data modification, but it can still lead to unintentional over-broad disclosure of sensitive organizational structure, resource inventory, quotas, and migration history.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically invokes package-management and installation commands that can alter the host environment without a prominent consent gate. For an agent skill whose purpose is querying cloud monitoring data, silent environment mutation is disproportionate and can surprise users into running privileged or persistent changes.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script fetches and executes bootstrap code from remote URLs without a strong, unavoidable warning or explicit consent, exposing users to supply-chain compromise. Given this skill's limited read-only monitoring scope, such behavior is unjustified and materially increases risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 94% confidence
Finding: The dependency is specified with only a lower bound, so installations may pull newer unreviewed versions with different behavior, newly introduced vulnerabilities, or breaking changes. In a cloud-monitoring skill that relies on SDKs for authentication and API access, supply-chain risk is real even though this file itself does not perform write operations.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 94% confidence
Finding: Using an unpinned IAM SDK allows future installs to resolve to any later version, which can introduce vulnerable or incompatible code without changes to the repository. Because this package likely participates in credentialed cloud access, compromise or regression in the dependency chain could affect authentication-related operations.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 94% confidence
Finding: The CES SDK is not pinned, so builds are not reproducible and may consume a later package release containing a security flaw or unexpected API behavior. Although the skill is read-oriented, it still interacts with cloud monitoring data and could be affected by SDK-level supply-chain issues.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkces>=3.1.0 huaweicloudsdkeps>=3.1.0
Confidence: 94% confidence
Finding: An unpinned EPS SDK permits drift to arbitrary newer versions at install time, increasing exposure to supply-chain compromise and unexpected runtime changes. The enterprise-project context may expose organizational metadata, so even a read-only skill should use deterministic, reviewed dependencies.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284