huawei-cloud-business-tf-support

Fail

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The environment setup script scripts/ensure_env.py includes logic to invoke system package managers like apt, yum, and dnf using sudo to install Python if the required version is not present.\n- [DYNAMIC_EXECUTION]: The script scripts/ensure_env.py uses os.execv() to perform process replacement, switching the current execution context to a virtual environment's Python interpreter. It also utilizes __import__() for dynamic module discovery.\n- [COMMAND_EXECUTION]: The skill uses subprocess.run() extensively within its setup scripts to create virtual environments, install dependencies, and execute system-level checks.\n- [EXTERNAL_DOWNLOADS]: scripts/ensure_env.py fetches the get-pip.py script from remote sources, including the vendor's own mirrors and official Python infrastructure, to facilitate package management setup.\n- [DATA_EXFILTRATION]: Both scripts/config.py and scripts/ensure_env.py contain configurations that explicitly disable SSL/TLS certificate verification for network requests, increasing the risk of data interception during communication with cloud APIs and external servers.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 9, 2026, 03:50 PM