huawei-cloud-agentarts-otel-ingestion
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the official Huawei Cloud CLI (hcloud/KooCLI) installation script from the vendor's storage domain (
hwcloudcli.obs.cn-north-1.myhuaweicloud.com). This is a legitimate vendor resource. - [COMMAND_EXECUTION]: The workflow relies on executing shell commands via the
hcloudCLI andcurlto interact with Huawei Cloud APIs for business creation, token management, and data verification. - [INDIRECT_PROMPT_INJECTION]: The skill describes an automated environment detection step that ingests external project data (e.g.,
package.json,pom.xml,requirements.txt). - Ingestion points: Local project configuration files are read in
SKILL.md(Step 1) to determine the application language. - Boundary markers: The skill does not implement specific delimiters or instructions to ignore potential commands embedded within these project files.
- Capability inventory: The skill utilizes CLI execution (
hcloud) and network requests (curl) to perform configuration and diagnostics. - Sanitization: No content sanitization of the detected project files is mentioned.
- [INDIRECT_PROMPT_INJECTION]: The file
references/test-report.mdincludes a pre-defined conclusion stating that all tests passed, which is a self-referential claim about the skill's safety and functional status that does not accurately reflect the skipped test logs in the same file.
Audit Metadata