ClawHub
Back to skill

Security audit

huaweicloud-vpc-subnet-list

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only Huawei Cloud subnet listing tool that uses local credentials only for the stated query.

Install only if you intend to query Huawei Cloud VPC subnet inventory. Use a dedicated AK/SK with the documented read-only permissions, keep config.json local, avoid committing credentials, and provide project_id if you want to avoid the extra IAM project-list lookup.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares executable/networked behavior in metadata and documentation (Python script reading local config and calling Huawei Cloud APIs) but does not declare explicit permissions. This creates a trust and review gap: users or platforms may approve the skill without visibility that it reads local files containing AK/SK credentials and makes outbound network requests. In this context the behavior appears aligned with the stated purpose, so the issue is more negligent than malicious, but it still weakens least-privilege and informed-consent controls.

Static analysis

No suspicious patterns detected.