huawei-cloud-skill-audit

• Outcome: Review
• Latest audit: Jul 29, 2026 · 4:52 AM UTC
• Version: 1.0.0

Overview

This audit skill is not clearly malicious, but it needs Review because it under-runs its advertised security checks and contains under-disclosed fallback installation code that can modify the host environment.

Review before installing. Run it in an isolated workspace with --no-install, set an explicit --output-dir, and do not rely on it as a five-check release gate until the registry, documentation, and skip-check behavior are aligned. Treat generated reports as sensitive because they may include credential snippets from scanned files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Run command with shell timeout wrapper to handle stubborn child processes (skill-scanner)."""
    try:
        shell_cmd = f"timeout --signal=KILL {timeout} " + " ".join(shlex.quote(c) for c in cmd)
        r = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True)
        return r.stdout + r.stderr, r.returncode
    except FileNotFoundError:
        return f"ERROR: command not found: {cmd[0]}", 127

• Confidence: 96% confidence
• Finding: r = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill's declared behavior does not fully match its documented and implied operational behavior, especially around auto-installation and downloading/extracting binaries from remote sources. Hidden or under-documented install and fetch behavior is dangerous because it expands the attack surface, can modify the local environment unexpectedly, and may introduce supply-chain risk if remote artifacts are tampered with.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The registry only enables and constructs two checks (`skillspector` and `gitleaks`) even though the skill metadata promises a five-check audit pipeline including `skillcheck`, `markdownlint-cli2`, and `hwcloud-spec`. This creates a security/compliance gap: users may rely on the audit as comprehensive when important validation stages never run, allowing malformed or noncompliant skills to pass review.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill's stated role is auditing, but it silently expands into package installation and environment mutation. That mismatch increases risk because users may invoke a read-only audit workflow without realizing it can fetch and install software from the network.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Extracting a downloaded archive into /usr/local/bin performs a system-level modification that exceeds the expected scope of an audit tool. If the archive is malicious or tampered with, this can place attacker-controlled executables on PATH and affect the whole host.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script downloads executables from third-party mirror URLs and installs them locally without strong provenance checks. In the context of a skill auditor that may be run in trusted CI or developer environments, this creates a substantial supply-chain compromise path.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The function claims to install a gitleaks binary, but actually extracts an entire tar archive into a privileged binary directory. That discrepancy hides the true behavior and can unintentionally deploy extra files or malicious payloads bundled in the archive.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Overly broad triggers can cause accidental invocation of a powerful auditing skill in unrelated contexts. Because the skill can scan files and may auto-install tools or make environment changes, unintended activation increases the risk of surprise execution, local modification, or disclosure of repository contents during normal conversation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that tools are auto-installed on first run but does not present this as a prominent safety warning or require explicit user consent. Silent or poorly disclosed environment modification is dangerous because it can alter the host system, fetch packages from external registries, and create supply-chain exposure without informed approval.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code auto-downloads and installs software without a prominent warning or affirmative confirmation from the user. This is risky because an audit command is expected to inspect files, not modify the system or introduce new binaries.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"""Run command with shell timeout wrapper to handle stubborn child processes (skill-scanner)."""
    try:
        shell_cmd = f"timeout --signal=KILL {timeout} " + " ".join(shlex.quote(c) for c in cmd)
        r = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True)
        return r.stdout + r.stderr, r.returncode
    except FileNotFoundError:
        return f"ERROR: command not found: {cmd[0]}", 127

• Confidence: 90% confidence
• Finding: subprocess.run(shell_cmd, shell=True, capture_output

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Available `--scan-level` values: `critical` (default), `high`, `quick`, `standard`, `deep`.
Available `--checks`: `skillspector`, `gitleaks`.
Use `--skip-checks` to exclude specific checks.

---

• Confidence: 88% confidence
• Finding: --skip-checks

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

skipped = {c.strip() for c in skip_arg.split(",")}
        invalid = skipped - DEFAULT_CHECKS
        if invalid:
            raise ValueError(f"Unknown checks in --skip-checks: {invalid}")
        enabled -= skipped
    return enabled

• Confidence: 89% confidence
• Finding: --skip-checks

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"""Run command with shell timeout wrapper to handle stubborn child processes (skill-scanner)."""
    try:
        shell_cmd = f"timeout --signal=KILL {timeout} " + " ".join(shlex.quote(c) for c in cmd)
        r = subprocess.run(shell_cmd, shell=True, capture_output=True, text=True)
        return r.stdout + r.stderr, r.returncode
    except FileNotFoundError:
        return f"ERROR: command not found: {cmd[0]}", 127

• Confidence: 92% confidence
• Finding: subprocess.run(shell_cmd, shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/skill_audit.py:130