huawei-cloud-find-skills

• Outcome: Review
• Latest audit: Nov 11, 2026 · 12:41 PM UTC
• Version: 1.0.8

Overview

ClawScan rates this skill suspicious with high confidence: scanners report exposed cloud credentials, behavior beyond skill discovery, default-on telemetry, and persistent installation of an auxiliary CLI; some files were only partly analyzed.

Consider not installing this skill unless you have reviewed its instructions and are comfortable with the reported credential exposure, cloud-operation examples, telemetry, and auxiliary CLI installation. The scan is incomplete: 13 of 16 components were fully inspected, and the installer scripts were partly inspected; the AIG scan completed without findings, but that does not resolve the coverage gaps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (80)

Tainted flow: 'req' from os.environ.get (line 97, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search-skills.py (reported line 98)May include surrounding context.

python

for attempt in range(MAX_RETRIES):
        try:
            req = Request(url, headers={"User-Agent": "huawei-cloud-find-skills/1.0"})
            with urlopen(req, timeout=HTTP_TIMEOUT) as resp:
                raw = resp.read().decode("utf-8")
            parsed = json.loads(raw)
            if is_api and isinstance(parsed, dict) and parsed.get("encoding") == "base64" and "content" in parsed:

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The command queries cloud identity resources rather than a skill catalog or installation mechanism. Although it uses Huawei Cloud tooling, listing IAM users is an undeclared capability and is not a necessary implementation detail of the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Index retrieval, local caching, keyword expansion, and ranking support the declared discovery functionality. However, report_search_results_impressions starts a background worker that POSTs identifiers formatted as skills// to an install-count increment endpoint. This reporting is not necessary to return search results and is not disclosed in the declared description; it is enabled unless SKILL_QUALITY_REPORT=0. Actual delivery is best-effort because the worker is a daemon thread. The script comments disclose this behavior, but the skill's declared purpose does not. Installation is also not demonstrated by this chunk, although it could be implemented elsewhere in the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose concerns skill discovery and installation, not credential disclosure. Printing the access key and secret key is an undeclared security-sensitive behavior, rather than a necessary supporting detail for that purpose. The supplied chunk does not show network transmission or skill discovery/install operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied command accesses the ECS /v2/{project_id}/flavors endpoint, which returns compute instance specifications, not skill listings, descriptions, or installation resources. Although it appears in a usage guide and is read-only, its demonstrated behavior is outside the declared skill-discovery and installation purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied commands target ECS infrastructure inventory, not a skill catalog. Although the description mentions ECS, it does so as a topic for finding relevant skills, not as authorization to query ECS servers directly. Displaying command help is benign, but the server-listing operation is a distinct, undeclared capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The command hcloud ECS ListFlavors retrieves cloud instance specifications, not available skills or their descriptions. This is a read-only cloud-service query outside the declared skill-discovery and installation purpose. The supplied chunk shows no skill search or installation behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose concerns a catalog of agent skills, whereas the code attempts a direct authenticated ECS service query. No skill discovery or installation behavior is shown, nor is the ECS query established as a supporting implementation detail for those functions. The missing os import limits execution but does not change the mismatch in intended behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Creating cloud infrastructure is a materially different capability from searching for or installing agent skills and can modify cloud account state or incur costs. The verification-oriented resource name suggests testing, but infrastructure provisioning is not disclosed in the declared purpose. The command is templated and appears in a usage guide, so the snippet does not establish that it executes automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied command queries ECS instances, not a skill catalog or skill installation service. Although the description mentions finding skills for managing ECS, it does not declare directly querying ECS resources. The chunk is labeled as an example, so it does not establish that the command is automatically executed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Telemetry CLI installation is disclosed in the body, so it is not entirely hidden, but the skill mandates persistent installation of the latest executable even for discovery-only requests. Adding its directory to PATH and linking into a writable PATH directory creates local supply-chain exposure beyond the user's catalog request; actual replacement behavior cannot be verified without the scripts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk is a cloud-operation executor and verifier, not a skill-catalog search or installation routine. It accepts service operations and parameters without restricting them to skill management, then attempts actual execution through CLI, SDK, and API interfaces. The --limit=1 argument does not establish a read-only or dry-run boundary. Although command verification could support a broader workflow, executing unrestricted cloud service operations is a material capability not disclosed by the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied command uses a service-specific Show operation targeting a cloud resource ID. It does not search, list, describe, or install agent skills, and the supplied chunk establishes no supporting relationship between this resource query and the declared skill-marketplace functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The CLI's telemetry purpose is explicitly disclosed, contrary to the finding's claim of complete nondisclosure. However, mandatory provisioning of a separate executable for ordinary searches remains an unnecessary persistent side effect without a separate authorization step.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The document explains the CLI's telemetry connection, but telemetry is unnecessary for the stated pure-Python search functionality. Mandating executable bootstrapping on every invocation expands local trust and persistence beyond what a discovery request needs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied commands create references, scripts, templates, and demo directories and initialize a skill definition from a template. This is a skill-development workflow, not the advertised search, browsing, or installation workflow. The chunk contains no catalog lookup, Huawei Cloud interaction, or retrieval of an existing skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied chunk concerns cloud-tool configuration rather than skill discovery or installation. Nothing shown connects credential and region configuration to implementing the declared skill-marketplace functions, so these constitute undeclared capabilities. The credentials are placeholders; the chunk does not demonstrate credential theft or exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied commands target cloud service resources through List and Show operations, including resource identifiers and regions. The description declares skill discovery and installation, not inspection of users' cloud resources. Although labeled as verification and limited to read-only operations, these commands introduce a distinct resource-access capability not disclosed in the description. The chunk does not show destructive operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied command performs diagram generation rather than Huawei Cloud skill discovery or installation. No connection to those declared functions is evident in the chunk, so this appears to be an undeclared capability rather than a demonstrated supporting implementation detail. The script's internal behavior is not supplied and cannot be assessed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied command performs diagram generation, which is not described as a capability and has no evident connection to Huawei Cloud skill discovery or installation. This appears to be a materially different function rather than an ordinary supporting implementation detail. The script's contents are not provided, so its internal behavior cannot be assessed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared purpose covers finding skills that may manage ECS, not directly listing ECS resources. The ListServers invocation therefore exceeds that purpose. The user-agent settings are supporting implementation details and are not themselves a mismatch. Although the reference file appears illustrative, the supplied shell command performs a resource-query operation if executed successfully.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The supplied chunk performs only a counter-update request. It does not retrieve skill information or install anything. Usage counting could support a broader discovery workflow, but no such workflow appears in this chunk, whose sole visible behavior is an undeclared remote metric update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

The supplied instructions introduce command execution and executor fallback behavior that the discovery-and-installation description does not disclose. This is more than listing or describing available skills. However, the referenced script is not supplied, so the exact commands, API calls, credential handling, and resource effects cannot be verified.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

`skill-quality-cli` (installed by `scripts/ensure_cli.sh` if absent) — no other CLI

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

- **`skill-quality-cli`** — **best-effort (Step 0.1)**: ensured by `bash scripts/ensure_cli.sh`