Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly aligned with Huawei Cloud skill discovery, but it installs persistent telemetry tooling and other skills through broad remote install commands that deserve review before use.
Install only if you are comfortable with default-on anonymous telemetry, a persistent skill-quality-cli under your user environment, and remote installation of additional Huawei Cloud skills through npx. Set SKILL_QUALITY_REPORT=0 before use if telemetry is not acceptable, and review the matched skill before allowing installation.
The skill's declared purpose omits mandatory telemetry transmission of search exposure and installation events, which is behaviorally significant and security-relevant. Undisclosed or understated outbound reporting can cause unexpected data egress and undermine informed consent, even if the transmitted fields are described as limited.
The skill's declared purpose omits mandatory telemetry transmission of search exposure and installation events, which is behaviorally significant and security-relevant. Undisclosed or understated outbound reporting can cause unexpected data egress and undermine informed consent, even if the transmitted fields are described as limited.
The skill's declared purpose omits mandatory telemetry transmission of search exposure and installation events, which is behaviorally significant and security-relevant. Undisclosed or understated outbound reporting can cause unexpected data egress and undermine informed consent, even if the transmitted fields are described as limited.
The skill's declared purpose omits mandatory telemetry transmission of search exposure and installation events, which is behaviorally significant and security-relevant. Undisclosed or understated outbound reporting can cause unexpected data egress and undermine informed consent, even if the transmitted fields are described as limited.
The statement that the skill is 'read-only' materially contradicts the documented behavior: it installs software, modifies filesystem locations, may alter PATH reachability, and installs other skills. This kind of misrepresentation is dangerous because it can cause users or review systems to underestimate host-modification risk.
The skill invokes shell commands, accesses environment variables, and performs outbound network requests, but it does not declare any explicit tool scope or permissions boundary. This makes the skill's effective capabilities broader than what a reviewer or runtime policy might expect, increasing the risk of unintended command execution, data egress, and environment modification.
The description says to invoke the skill to "search, list, query, discover, browse, find and install any Huawei Cloud agent skill," which bundles many common intent words and broadens activation beyond a narrowly defined trigger. Although examples are provided, the activation boundary is still unclear because it does not specify exclusion cases or a strict trigger scope, increasing the chance of unintended invocation.
The skill claims to handle only discovery and installation, but it also performs mandatory outbound telemetry and reporting unrelated to the user's core task. Even with limited payloads, default-on reporting broadens the attack surface and creates privacy and policy concerns because network egress becomes part of every invocation.
The skill requires installation and auto-linking of an external telemetry CLI into the user's environment, including PATH-related changes and local binary placement. That goes beyond simple discovery and creates a persistent trust anchor on the host, increasing supply-chain and local-environment risk if the fetched tool is compromised or later abused.
Using npx skills without pinning an exact package version introduces supply-chain risk because a future or compromised package release could change behavior and execute untrusted code at install time. In this skill, those commands are part of the documented install path, so the unpinned dependency directly affects users who follow the instructions.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install python3
sudo apt-get install python3
2. **Verify after install**: Run `python --version` again to confirm Python 3.6+ is available
The skill performs an outbound POST request to a remote telemetry endpoint during installation, sending a constructed skill_id and doing so as a mandatory step in the workflow. External transmission is security-relevant because it creates data egress, expands network trust, and can be unexpected in environments that allow discovery but prohibit unsolicited reporting.
⚠️ MANDATORY (质量上报): 安装计数请求同样用
run包装, 保证安装流程触发质量上报。
skill-quality-cli run --skill-name huawei-cloud-find-skills -- curl -s -X POST "https://devdata2.huaweicloud.com/rest/developer/fwdo/rest/developer/servlet/hdskillservice/v1/obs/findcounts/increment" -H "Accept: application/json, text/plain, */*" -H "Content-Type: application/json" -H "Origin: https://skills.huaweicloud.com" -H "Referer: https://skills.huaweicloud.com/" -d "{\"skill_id\":\"skills/<category>/<service>/<skill-name>\"}"
This is a fire-and-forget request. Do NOT block the install flow on its success or failure.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The installation workflow relies on npx skills add without a pinned version, allowing code from the current registry state to be executed on the user's machine. Because this step installs additional skills from remote repositories, an attacker could chain package compromise with malicious skill content for significant code-execution impact.
The acceptance criteria explicitly require fire-and-forget reporting of each returned skill name to an install-count API, but the document does not disclose this outbound telemetry to users or require consent. Even if only skill names are sent, this leaks user search/discovery behavior to an external service and creates an undisclosed data flow from a nominally read-only search feature.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The guide mandates executing bash scripts/ensure_cli.sh on every skill run even though this skill is only for discovering Huawei Cloud skills, creating unnecessary code execution and expanding the trust boundary. Because the referenced CLI is for telemetry rather than the core browsing function, users may be induced to run local scripts with side effects unrelated to the stated purpose, which is a supply-chain and privacy risk.
The document states telemetry is automatic and only provides an opt-out afterward, without clearly warning users before installation or execution that reporting may occur. In a skill whose purpose is simply to find or browse other skills, silent or poorly disclosed telemetry is more dangerous because users would not reasonably expect operational reporting to be enabled as a condition of use.
The document states that search results trigger fire-and-forget reporting to an install-count API, but it does not clearly warn users that network telemetry is being sent. Silent reporting creates a privacy and trust issue because users may unknowingly transmit usage data during what appears to be a local search/verification workflow.
No suspicious patterns detected.