huawei-cloud-business-tf-support
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The environment setup script
scripts/ensure_env.pyincludes logic to invoke system package managers likeapt,yum, anddnfusingsudoto install Python if the required version is not present.\n- [DYNAMIC_EXECUTION]: The scriptscripts/ensure_env.pyusesos.execv()to perform process replacement, switching the current execution context to a virtual environment's Python interpreter. It also utilizes__import__()for dynamic module discovery.\n- [COMMAND_EXECUTION]: The skill usessubprocess.run()extensively within its setup scripts to create virtual environments, install dependencies, and execute system-level checks.\n- [EXTERNAL_DOWNLOADS]:scripts/ensure_env.pyfetches theget-pip.pyscript from remote sources, including the vendor's own mirrors and official Python infrastructure, to facilitate package management setup.\n- [DATA_EXFILTRATION]: Bothscripts/config.pyandscripts/ensure_env.pycontain configurations that explicitly disable SSL/TLS certificate verification for network requests, increasing the risk of data interception during communication with cloud APIs and external servers.
Recommendations
- AI detected serious security threats
Audit Metadata