huawei-cloud-business-tf-support
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The environment setup script (
scripts/ensure_env.py) usessubprocess.runto manage the execution environment. - It creates a Python virtual environment (
.venv) to isolate dependencies. - On Linux systems, it may use
sudo aptoryumto install Python 3.6+ if it is missing from the host. - It executes
pip installto fetch the required Huawei Cloud SDK packages. - [EXTERNAL_DOWNLOADS]: The skill fetches components from official and well-known repositories.
- It downloads the official
get-pip.pyscript frommirrors.huaweicloud.comorbootstrap.pypa.ioif pip is not found. - It utilizes trusted regional mirrors (Tsinghua, Aliyun, and Huawei Cloud) to install Python packages efficiently.
- [REMOTE_CODE_EXECUTION]: The setup script executes the downloaded
get-pip.pyand restarts itself usingos.execvonce the virtual environment is ready. These actions are performed to ensure the tool runs in a stable, pre-configured environment using official libraries. - [SAFE_PRACTICES]: The skill implements security best practices for resource querying.
- It uses standard environment variables for credential management (
HW_ACCESS_KEY,HW_SECRET_KEY). - Documentation and scripts explicitly advise against logging or outputting these sensitive keys.
- All scripts are designed for read-only operations to prevent accidental modification of cloud resources.
Audit Metadata