Security audit

huawei-cloud-storage-query

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a read-only Huawei Cloud storage query tool, but it needs Review because setup and runtime use real cloud credentials, install network dependencies, disable TLS verification, and expose sensitive tenant/access metadata.

Install only if you are comfortable with a skill that runs local setup, installs Python packages, uses Huawei Cloud AK/SK credentials, queries live tenant data, and may print sensitive project, ACL, LDAP, backup, and agent metadata. Use least-privilege read-only credentials, avoid broad prompts that accidentally trigger it, and review or patch the TLS verification and get-pip fallback before use in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares itself as a query tool but instructs execution of shell commands, use of environment variables containing cloud credentials, and outbound network access, while no permissions are declared. That creates hidden execution capability and weakens trust boundaries, because users or platforms may invoke it assuming a low-risk read-only skill when it can also run setup logic and contact external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a genuine security issue because the documented behavior goes beyond read-only storage queries into environment mutation, dependency installation, possible OS package installation, remote bootstrap code retrieval, and IAM/credential validation. Those extra behaviors expand the attack surface significantly and can lead to arbitrary code execution, supply-chain compromise, credential exposure risk, or insecure transport if SSL verification is disabled or bypassed.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This script enumerates tenant/domain projects via CBR using a supplied domain name, which expands the skill beyond its declared storage-resource query scope. Even though it is read-only, project enumeration exposes organizational topology and can aid reconnaissance, especially when combined with other cloud queries.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Accepting a domain name and returning project IDs/names provides domain-to-project enumeration that is not necessary for the stated purpose of querying storage resources. This metadata can reveal internal account structure and lower the cost of follow-on targeting across projects or regions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This script calls CBR `list_projects` and outputs project identifiers and domain information, which is broader than the skill's declared storage-resource query scope. Project enumeration enables account/environment discovery that can aid follow-on reconnaissance, especially when exposed through an agent skill intended for narrower storage queries.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The argument handling and credential setup allow the script to operate with an arbitrary `project_id`, then enumerate projects via the cloud API. For a storage-query skill, this introduces unnecessary account/project discovery capability, increasing the attack surface and exposing metadata useful for privilege mapping and lateral reconnaissance.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This code invokes `show_domain` and prints `project_name`, `project_id`, `domain_id`, and `domain_name`, which exposes tenant/domain identity metadata rather than storage-resource state. In a skill advertised as read-only storage querying for EVS/OBS/SFS/CBR resources, this expands data access into account-level enumeration and can disclose sensitive cloud organizational information useful for reconnaissance or cross-project targeting.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The argument parsing and request setup introduce cross-project tenant metadata lookup (`--source_project_id`) without a clear connection to the stated purpose of querying storage resources like vaults, backups, or policies. Even though the operation is read-only, it enables collection of domain and project identifiers that may facilitate cloud account mapping and violate least-privilege expectations for this skill.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This helper goes beyond the skill's declared read-only cloud-storage query purpose by attempting to install Python itself via OS package managers. In an agent/tooling context, expanding from passive querying to host modification materially increases blast radius, may require elevated privileges, and can alter the user's machine without necessity for the stated task.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script automatically installs or upgrades dependencies even though the skill is described as query-only. In a security-sensitive agent setting, mutating the local environment and fetching packages from the network exceeds least privilege and creates supply-chain and system-integrity risk unrelated to the user-facing read-only function.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: These code paths execute privileged local package-management commands such as sudo apt/yum/dnf to modify the host system, which is unrelated to merely querying Huawei storage resources. In an agent skill, such behavior is dangerous because it can trigger unexpected privilege escalation prompts, system changes, or installation of software on the operator's machine.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The script downloads get-pip.py from remote URLs and immediately executes it, while also disabling TLS verification elsewhere in the file. This creates a direct remote-code-execution and supply-chain compromise path on the local host that is far beyond the storage-query purpose and especially dangerous in an automated agent environment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script fetches and prints LDAP configuration details including the LDAP URL, Base DN, and User DN directly to stdout. While this is a read-only operation, these values expose internal directory integration details that can aid reconnaissance, especially if logs, terminal history, or downstream tooling capture the output. In the context of a storage-query skill, exposing identity/backend directory configuration is more sensitive than ordinary storage inventory data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger set includes generic terms like 'bucket', 'volume', and 'backup', which can cause the skill to activate in contexts unrelated to Huawei Cloud storage. Over-broad invocation is dangerous because it can unexpectedly run the environment-check and execution flow, increasing the chance of unnecessary credential use, network activity, or shell execution.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script automatically loads cloud credentials and performs a live Huawei Cloud CBR API request based on user-supplied identifiers, but it provides no explicit disclosure, confirmation, or boundary around the fact that it is using real credentials against a real tenant. In an agent/skill context, this can cause unintended sensitive metadata exposure or unexpected access to cloud resources when invoked by a user who does not realize the operation is live.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script prints bucket ACL details including owner ID, grantee IDs, display names, URIs, and permissions directly to stdout. In a query-oriented skill, this can expose sensitive access-control metadata to logs, downstream tools, or users who may not need full privilege information, increasing reconnaissance value for an attacker or causing accidental data disclosure.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0
Confidence: 90% confidence
Finding: The dependency is specified with only a lower bound, so installs may resolve to newer unreviewed versions over time. This creates supply-chain risk because a compromised or breaking upstream release could be pulled into the skill without explicit approval, even though the file itself contains no direct malicious behavior.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0
Confidence: 90% confidence
Finding: Using a non-pinned IAM SDK dependency allows environment builds to fetch different versions at different times, which weakens reproducibility and increases exposure to malicious or unsafe upstream releases. Because this skill likely handles cloud authentication context indirectly through Huawei SDKs, dependency integrity matters.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 90% confidence
Finding: The EVS SDK is declared with a minimum version only, permitting silent upgrades to later versions that may introduce vulnerabilities or malicious code if the supply chain is compromised. While this is a read-focused storage skill, it still interacts with cloud resource metadata, so dependency trust is relevant.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkcore>=3.1.0 huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 90% confidence
Finding: An unpinned SFS Turbo SDK dependency reduces build determinism and can expose deployments to unintended upstream package changes. In a cloud-query skill, a compromised dependency could affect credential handling, API responses, or data exposure paths even if the skill is nominally read-only.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkiam>=3.1.0 huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 90% confidence
Finding: The OBS SDK dependency is not pinned, so future installations may consume newer package versions without review. Since this skill can enumerate buckets and objects, a compromised dependency could affect access to sensitive storage metadata or contents despite the lack of explicit write operations.

Unpinned Dependencies

Low

Category: Supply Chain
Content: huaweicloudsdkevs>=3.1.0 huaweicloudsdksfsturbo>=3.1.0 huaweicloudsdkobs>=3.1.0 huaweicloudsdkcbr>=3.1.0
Confidence: 90% confidence
Finding: The CBR SDK is allowed to float above a minimum version, which introduces supply-chain and reproducibility risk. Although the stated functionality is query-only, backup and vault metadata can be sensitive, so consuming an unreviewed upstream package still presents a real but low-severity risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/ensure_env.py:284