huawei-cloud-vod-collector

• Outcome: Review
• Latest audit: Aug 22, 2026 · 2:39 PM UTC
• Version: 1.0.1

Overview

This feedback skill is mostly purpose-aligned, but it captures sensitive conversation context and can install helper software, use local tokens, and submit data externally with insufficient scoping and confirmation.

Review this skill before installing. Only use it if you are comfortable with automatic feedback capture, local .vod records, external GitCode issue submission, AtomGit-GO installation, and plaintext local token storage. Configure or restrict hooks, review and sanitize feedback before delivery, avoid @filepath inputs for sensitive files, and verify the external helper source before running the installer.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill exposes substantial capabilities—filesystem access, shell execution, network use, environment access, and file writes—without declaring permissions or obtaining explicit scoped authorization. This reduces transparency and prevents policy engines or reviewers from accurately understanding what the skill can do before it runs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to collect feedback, but it also installs software, starts local servers, performs login flows, accesses local auth tokens, and creates remote issues. This mismatch is dangerous because users and orchestration systems may invoke it expecting passive note collection, while it actually performs privileged actions and external data transmission.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The template explicitly requires storing full dialog content and even assistant chain-of-thought in a feedback artifact. For a Huawei Cloud VoD feedback collection skill, this exceeds what is necessary to diagnose product issues and creates a high risk of collecting sensitive user data, internal reasoning, secrets, or regulated information without justification.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The configuration automatically delivers captured feedback to an external Git repository, which turns a local feedback-capture feature into outbound data exfiltration by default once enabled and configured. Because the same skill also collects dialog context and environment details, sensitive user content, internal error traces, or system metadata could be committed to a third-party repository without sufficient review or minimization.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: Enabling environment collection exceeds the minimally necessary scope for capturing user-experience feedback and may gather host, runtime, or deployment details that are not needed for a bug report. In combination with context capture and delivery features, this increases privacy and security exposure by broadening the amount of potentially sensitive metadata that can be stored or transmitted.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The acceptance criteria expand the skill from simple VOD feedback collection into broader extraction, sanitization, deduplication, and external delivery workflows. This kind of scope drift is dangerous because it authorizes more data handling and outbound actions than the user-facing purpose suggests, increasing the chance of over-collection, unauthorized transmission, or misuse of user-provided content.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Automatic login and credential storage are high-risk capabilities that are not necessary for a narrowly scoped feedback collector. Embedding an install/login flow and persisting tokens to a local auth file creates a credential-handling surface that could be abused to obtain repository access, perform unauthorized submissions, or expose secrets if the flow is triggered unexpectedly or implemented unsafely.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The `_resolve_value` helper treats any argument beginning with `@` as a local filesystem path and reads the file contents without restriction, validation, or scope limitation. In a feedback-collection skill, this creates an unintended local file disclosure primitive that can pull sensitive host data into generated feedback records, which is unrelated to the stated purpose and could expose secrets, tokens, configs, or user data.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring explicitly characterizes `@filepath` handling as 'safe' even though the implementation performs unrestricted reads from caller-controlled paths. This misleading assurance increases the chance that integrators will trust and enable behavior that can exfiltrate local files into persistent output, making misuse more likely and harder to detect.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill reads local AtomGit authentication material, including access tokens and user metadata, from a default home-directory location. That expands the skill from simple feedback collection into credential handling and outbound authenticated actions, which is sensitive and not clearly justified by the declared purpose, increasing the chance of unauthorized issue creation or token misuse if the skill is invoked unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 88% confidence
• Finding: The skill can start and stop external login-server processes on the host, which is a system-level capability beyond normal feedback reporting. In the skill context this is more dangerous because a user invoking a feedback collector would not reasonably expect background service management, creating risk of unintended process execution, persistence, or disruption.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script’s behavior is materially inconsistent with the stated skill purpose of collecting Huawei Cloud user feedback. Instead of handling feedback data, it installs unrelated third-party binaries by cloning and building external code, which is a strong indicator of disguised functionality and creates a supply-chain execution path on the user’s machine.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Cloning a remote repository and invoking build tooling gives the skill an unnecessary capability to fetch and execute unreviewed code, which is unjustified for a feedback-collection workflow. Because the repository can change over time and no commit pinning, signature verification, or integrity checks are used, this introduces a significant remote code and supply-chain risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill claims to collect Huawei Cloud user feedback, but the script instead clones an unrelated external repository and installs executables into the user's local bin directory. That mismatch is dangerous because it introduces arbitrary code onto the host under a misleading purpose, increasing the risk of supply-chain compromise or deceptive installation of software the user did not meaningfully consent to.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script creates ~/.local/bin, extracts binaries there, changes permissions, and creates compatibility symlinks, all of which are persistent local-executable management actions unrelated to a feedback-reporting workflow. In this skill context, such behavior is unjustified and dangerous because it can place attacker-controlled binaries in the user's PATH, enabling execution later under the guise of a harmless reporting tool.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger scope is very broad, covering generic dissatisfaction and bug-report phrases across Huawei Cloud topics. Overly broad activation increases the chance the skill runs in contexts where the user did not intend local persistence, sanitization, or remote submission of conversation-derived content.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The markdown schema instructs retention of full conversation content and chain-of-thought without any warning, minimization rule, or privacy safeguard. That makes overcollection likely by default and increases the chance that confidential user inputs, system prompts, internal policy text, or sensitive operational data will be copied into long-lived records.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: A dedicated field for assistant chain-of-thought is a direct policy and security concern because it invites storage of internal reasoning that may contain hidden instructions, sensitive inferences, or confidential operational context. Capturing this data is not needed for normal bug reporting and materially increases exposure if records are accessed, shared, or breached.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that the skill automatically captures exception events and user rejection events, and the examples show collection of raw user_input plus tool stdout/stderr. Those fields can easily contain secrets, personal data, internal prompts, file contents, or credentials, yet the document provides no privacy warning, consent guidance, minimization rules, or redaction requirements. In this skill context, automatic telemetry from Huawei Cloud issue-reporting flows makes the risk more credible because the trigger condition is user dissatisfaction/errors, which often coincides with verbose logs and sensitive troubleshooting data.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: `write_feedback_md` persists extensive context to disk, including session identifiers, dialog context, agent actions, environment values, and error details, with no disclosure or minimization in this file. In a feedback/VoD collection skill, these fields can contain personal data, internal reasoning, secrets, or operational metadata, so silent collection and storage materially increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The same `@filepath` expansion allows arbitrary local file contents to be imported and then written into feedback markdown output, again without any user-facing disclosure or approval path in this file. That compounds the privacy issue into direct local data exfiltration and persistence, especially dangerous in an agent skill that may be invoked during troubleshooting when users or operators may not expect host file ingestion.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The function rewrites feedback markdown files in place to append or replace delivery metadata without backup, locking, or explicit confirmation. In this context, silent local modification is risky because a reporting skill is expected to collect and transmit feedback, not alter source records, which can lead to accidental data loss, tampering, or audit ambiguity.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The update-status command overwrites local feedback content directly based on user-supplied status, with limited safeguards and no user-facing warning. Because this skill’s advertised role is feedback capture/delivery, hidden mutation of existing records is more dangerous than usual and can undermine integrity of incident or bug-report evidence.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script performs a recursive forced deletion of the repository directory without prompting the user or clearly warning about the cleanup action. While the current logic intends to delete only a temporary clone, silent destructive operations are risky and can cause unintended data loss if path handling is altered, influenced, or later regresses.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script downloads code from a remote repository and immediately builds it without presenting any safety notice or trust boundary warning to the user. Even if build commands are not directly executed as the final payload, running toolchains on attacker-controlled source can trigger malicious build steps or compile trojanized binaries, making the lack of warning and validation dangerous.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.