huawei-cloud-ces-list

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 3:29 PM UTC
• Version: 1.0.1

Overview

The skill is a disclosed read-only Huawei Cloud CES metrics query helper, with credential-handling and raw-output risks users should manage carefully.

Install only if you need read-only Huawei Cloud CES metric queries. Use a dedicated IAM user with only CES metric list/get permissions, avoid production-wide AK/SK where possible, verify the hcloud installer before running it, and remember that returned metric metadata may reveal cloud resource identifiers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

whose name contains ACCESS_KEY / SECRET_KEY or ends with _AK / _SK.
    """
    ak, sk = "", ""
    for key, val in os.environ.items():
        upper = key.upper()
        if not (upper.startswith("HUAWEI") or upper.startswith("HW") or upper.startswith("HWC")):
            continue

• Confidence: 89% confidence
• Finding: The credential loader broadly scans all environment variables and accepts very generic names such as `AK` and `SK`, increasing the chance of accidentally ingesting unrelated or attacker-influenced secrets in a shared runtime. In an agent/skill context, environment harvesting is more dangerous because the skill may have access to many ambient secrets beyond the intended Huawei credentials, and loose matching can cause credential confusion or unintended secret use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes code-capable behavior via environment-variable access and shell/CLI execution (`hcloud`) but does not declare a restrictive tool scope such as `permissions` or `allowed-tools`. In an agent environment, that omission can let the skill run with broader-than-expected capabilities, increasing the chance of unintended command execution or credential exposure through ambient access.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad and generic for Huawei Cloud monitoring queries, without constraints that limit when the skill should activate or clear exclusions to prevent invocation in unrelated contexts. In an agent setting, broad triggers can cause over-activation of a shell-capable skill, leading to unintended external API calls using ambient credentials and unnecessary exposure of cloud metadata.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire acceptance criteria file is written in Chinese and provides no indication that language selection is optional or tied to a documented regional requirement. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to download and execute a remote shell installer from the network, but provides no integrity verification, signature check, pinning, or warning about the risks of running fetched code. In a security-sensitive cloud skill that will later handle credentials, this creates a supply-chain risk: if the download source, transport, or hosting is compromised, users could execute attacker-controlled code on their machine.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide tells users to create and export cloud Access Key and Secret Key credentials, and even encourages broad environment-variable pattern scanning, without clearly warning that these are highly sensitive secrets. In the context of a cloud-monitoring skill using AK/SK authentication, exposed credentials could enable unauthorized access to the user's cloud account, especially if environment variables are leaked through shell history, process inspection, logs, debugging output, or overly permissive scanning logic.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the skill dynamically scans environment variables for AK/SK and injects them into the hcloud CLI, which is sensitive credential handling. There is no accompanying warning about reading credentials from the environment, exposing them to subprocesses, or the associated privacy/security implications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly states that it outputs API responses to stdout with all fields preserved, without any filtering or warning. Even for a read-only CES workflow, upstream APIs can return unexpected identifiers, resource metadata, dimension values, or other sensitive operational details, and emitting them verbatim increases the chance of unintended disclosure to users, logs, transcripts, or downstream tools.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Preserving and disclosing all fields from API responses semantically encourages broad data disclosure rather than least-privilege output. In a cloud-monitoring context, this can expose full dimension sets, resource identifiers, and ancillary metadata to any caller or system capturing stdout, making the skill more dangerous because cloud inventory and telemetry data often have security value even when the operation is read-only.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

] + params

    try:
        proc = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The verification instructions tell users to export long-lived Huawei Cloud AK/SK credentials directly into shell environment variables without any warning about sensitivity, shell history exposure, process inheritance, or use of least-privilege test credentials. In a security-sensitive skill, this can normalize unsafe credential handling and increase the chance of accidental leakage during testing, logging, screenshots, or reuse in shared environments.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This JSON manifest contains natural-language strings in Chinese for test names and expected-result text throughout the file. Because the skill does not indicate that it is region-specific or offer a language choice, this creates a language/locale policy issue under the natural-language policy rule.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language content of the skill file forces a specific language for all users. Under the stated policy, language-specific content should either provide user choice or clearly justify the locale limitation.

Static analysis

No suspicious patterns detected.