ClawHub
Back to skill

Security audit

huawei-cloud-network-query

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a read-only Huawei Cloud inventory tool, but its mandatory setup and HTTPS handling create review-worthy local execution and credential-traffic risks.

Review before installing. Use only isolated environments and least-privilege, read-only Huawei Cloud credentials. Avoid running the setup until TLS verification is restored, get-pip.py bootstrapping is removed or verified, and dependency installation is made explicit and user-controlled.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/ensure_env.py:275
Finding

Unverified Remote Python Bootstrap Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: scripts/ensure_env.py, lines 275–294
Vulnerability Type: Unauthenticated remote payload retrieval and execution
Risk Level: High

Vulnerable code:

python
get_pip_path = os.path.join(tempfile.gettempdir(), "get-pip.py")
urls = [
    "https://mirrors.huaweicloud.com/repository/pypi/simple/get-pip.py",
    "https://bootstrap.pypa.io/get-pip.py",
]

ctx = ssl._create_unverified_context()

for url in urls:
    info(f"尝试下载 get-pip.py: {url}")
    try:
        urllib.request.urlretrieve(url, get_pip_path, context=ctx)
    except Exception as e:
        print(f"    下载失败: {e}")
        continue

    rc, out, err = run_cmd([sys.executable, get_pip_path], timeout=120)

The file also globally replaces Python's default HTTPS context at line 25:

python
ssl._create_default_https_context = ssl._create_unverified_context

Technical Analysis

The mandatory environment setup attempts to bootstrap pip when neither pip nor ensurepip is available. It downloads a Python program from one of two external URLs while explicitly constructing an SSL context that does not authenticate the remote certificate. The module additionally replaces the process-wide default HTTPS context with an unverified context.

After downloading the response to a predictable temporary path, the setup passes that file directly to the current Python interpreter. There is no cryptographic digest, signature, or content verification between retrieval and execution.

This creates a direct trust-boundary transition from a network response to local code execution. An attacker able to intercept the network connection, control a relevant proxy, or otherwise present an untrusted TLS endpoint can substitute arbitrary Python code for the expected bootstrap script.

This is a security defect rather than evidence that the project author intentionally supplies a malicious payload. The conf ...[truncated 1839 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the process-wide TLS override:
    python
    ssl._create_default_https_context = ssl._create_unverified_context
  2. Do not create or pass an unverified SSL context. Use Python's default authenticated TLS configuration.
  3. Prefer failing safely with documented manual installation instructions when both pip and ensurepip are unavailable.
  4. If automatic bootstrapping is required, retrieve the bootstrap artifact only from an authenticated canonical source.
  5. Pin an expected SHA-256 digest or verify a trusted digital signature before execution.
  6. Create the temporary file securely with a restrictive mode and remove it in a finally block.
  7. Abort installation if certificate, signature, or digest verification fails; do not silently continue to another unauthenticated execution source.
  8. Add tests that confirm downloads fail for expired, mismatched, self-signed, and otherwise untrusted certificates.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/config.py:104
Finding

TLS Certificate Verification Is Disabled for Authenticated Huawei Cloud API Traffic

Content
View full analysis

Vulnerability Details

File Location: scripts/config.py, lines 104–105
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable code:

python
def build_http_config():
    """构建 HTTP 配置，代理支持环境变量

    代理 URL 来源（优先级从高到低）:
      1. HTTPS_PROXY
      2. HTTP_PROXY

    代理 URL 格式:
      - http://host:port
      - http://user:pass@host:port
    """
    http_config = HttpConfig.get_default_config()
    http_config.ignore_ssl_verification = True
    http_config.timeout = (30, 60)
    http_config.retry_times = 3

Certificate warnings are also suppressed globally at lines 8–9:

python
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

Technical Analysis

build_http_config() is the shared configuration path used by the Skill's Huawei SDK clients. It explicitly instructs the SDK to accept HTTPS servers whose certificates cannot be authenticated.

The configuration is used for credential validation, automatic project-ID resolution, and service queries. For example, scripts/vpc/list_vpcs.py obtains this configuration and supplies it to an authenticated VpcClient:

python
http_config = build_http_config()

client = VpcClient.new_builder().with_http_config(http_config).with_credentials(
    BasicCredentials(AK, SK, args.project_id)
    if not SecurityToken
    else BasicCredentials(AK, SK, args.project_id).with_security_token(SecurityToken)
).with_region(VpcRegion.value_of(Region)).build()

Disabling certificate validation means HTTPS encryption no longer authenticates the Huawei Cloud endpoint. A network-positioned attacker or malicious proxy can impersonate the endpoint with an arbitrary certificate. Suppressing InsecureRequestWarning further conceals this degraded security state from the operator.

This affects all scripts that use the shared helper, rather than only one resource-query command.

Attack Path

...[truncated 2002 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the insecure override or explicitly enable verification:
    python
    http_config.ignore_ssl_verification = False
  2. Remove global suppression of InsecureRequestWarning.
  3. Use the operating system or Python trust store for public Huawei Cloud endpoints.
  4. If an approved enterprise TLS-inspection proxy is required, configure a narrowly scoped CA bundle containing the organization's trusted root rather than disabling verification.
  5. Validate proxy configuration and reject malformed or unsupported proxy schemes.
  6. Document any custom CA requirements and fail closed when certificate validation cannot be completed.
  7. Add integration tests ensuring that self-signed, expired, hostname-mismatched, and untrusted certificates are rejected.
  8. Rotate temporary credentials if they were used over connections where endpoint authenticity could not be assured.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (101)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is a read-only Huawei Cloud network query skill, but the documented behavior includes local environment inspection, dependency installation, and execution of setup/check scripts. That mismatch is dangerous because users may consent to benign cloud queries while the skill performs host-side changes and broader execution actions they did not reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly documents a script to query the certificate private key echo switch, which is a security-sensitive setting related to potential private-key exposure behavior, yet provides no warning, access restrictions, or safe-use guidance. In a network/security discovery skill, surfacing such capability without caution can normalize inspection of dangerous configuration states and increase the chance of exposing key material or misusing systems where private-key echo is enabled.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/check_env.ps1 (reported line 1)May include surrounding context.

text
<#
华为云资源查询 - 环境检查前置脚本 (Windows PowerShell)
#>

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/check_env.sh (reported line 39)May include surrounding context.

sh
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/ensure_env.py (reported line 186)May include surrounding context.

python
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This helper creates a virtual environment and re-executes itself automatically, introducing host modification and process-control behavior that exceeds the skill's declared read-only Huawei Cloud network query scope. In an agent setting, this mismatch is dangerous because users may invoke a supposedly query-only skill and unexpectedly trigger local environment changes.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/ensure_env.py (reported line 69)May include surrounding context.

python
# 用 venv Python 重新执行当前脚本
    print(f"  使用虚拟环境 Python: {venv_python}")
    os.execv(venv_python, [venv_python] + sys.argv)

def info(msg):
    print(f"  {msg}")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script can invoke privileged OS package managers such as apt, yum, dnf, and brew, which are unrelated to querying Huawei Cloud network resources. This broadens the blast radius from cloud read access to local system modification, increasing the risk of unintended privilege use and host compromise through package installation paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script downloads tooling and installs Python dependencies from external package sources, which is a substantial expansion from read-only cloud querying into local software installation and supply-chain exposure. In the skill context, this is especially risky because agents may run setup helpers automatically, causing unreviewed network fetches and package execution on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script downloads and executes get-pip.py from external URLs without explicit confirmation, and the file is fetched under globally disabled TLS certificate verification. This creates a severe remote code execution and supply-chain risk, because a network attacker or compromised mirror could deliver arbitrary Python code that the script then runs locally.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs execution of shell commands, local Python scripts, network access, and use of credential-bearing environment variables, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens policy enforcement and transparency, making it easier for the skill to overreach into host command execution and external network operations without clear user or platform constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad generic terms like 'network' and 'security group', which can cause the skill to activate in loosely related conversations. Over-broad triggering is risky here because activation leads to host-side environment checks, potential dependency installation, and credentialed cloud queries, increasing the chance of unintended execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation describes a read-only network query skill but simultaneously advertises generic cloud resource, image, and disk queries. This inconsistency can mislead operators about what data the skill may access, causing overly broad invocation and exposure of cloud inventory outside the expected task context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as network-focused, but its documented scope expands into unrelated resource domains such as images and cloud disks. Scope expansion increases the chance of over-collection of sensitive cloud inventory data and undermines least privilege, especially when combined with credentialed scripts and broad execution instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill mandates automatic environment validation and dependency installation as an initial step, but does not provide a clear up-front user warning that it may modify the local system. Silent or implicit setup actions are dangerous because they execute code and change the environment before the user has explicitly consented to those changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents scripts that retrieve certificate details, including fingerprint, common name, source, and other certificate-related metadata, and elsewhere references a certificate private key echo switch. The guide provides no user-facing warning that running these commands may surface sensitive security information that should be handled carefully.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file describes read-only scripts, but several commands explicitly retrieve sensitive infrastructure data such as CA certificates, VPN gateway IPs, tunnel addresses, client usernames, and raw connection logs. The guide does not warn users that command output may contain confidential network, certificate, or user information that should be handled carefully.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_env.sh (reported line 39)May include surrounding context.

sh
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_env.sh (reported line 40)May include surrounding context.

sh
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_env.py (reported line 186)May include surrounding context.

python
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_env.py (reported line 187)May include surrounding context.

python
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_env.py (reported line 188)May include surrounding context.

python
echo ""
    echo "请先安装 Python 3.6+，根据当前系统参考："
    echo "  macOS   : brew install python"
    echo "  Ubuntu  : sudo apt update && sudo apt install -y python3 python3-pip"
    echo "  CentOS  : sudo yum install -y python3"
    exit 1
fi

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest frames this skill as querying Huawei Cloud network resources such as VPC, ELB, NAT, VPN, and DNS objects. This function calls the IAM KeystoneListProjects API to enumerate accessible projects and derive a project ID, which is an account/identity capability not described in the stated skill purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code globally disables TLS certificate verification for Huawei Cloud SDK requests by setting ignore_ssl_verification = True, while also suppressing the associated warnings. This enables man-in-the-middle interception or tampering of cloud API traffic, including exposure of credentials, tokens, and sensitive network configuration data, especially when proxies are used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's description and help text are written only in Chinese, and all user-visible status/error messages are likewise fixed to Chinese. This imposes a specific language on all users without opt-in or documentation that the tool is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/dns/list_api_versions.py:31

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/ensure_env.py:284