huawei-cloud-cdn-certificate-diagnosis
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts (
cert_probe.py,cert_expiry_check.py) using arguments supplied by the user or fetched from the Huawei Cloud API. While this involves command-line execution, the risk is mitigated by regex-based domain validation and strict type checking within the scripts. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and parses metadata from external SSL/TLS certificates (Common Names, Subject Alternative Names, Issuer) provided by the server being probed. As this data is attacker-controllable and later integrated into an agent-facing report, it constitutes a surface for indirect prompt injection.
- Ingestion points: External certificate fields parsed by the
cert_probe.pyscript. - Boundary markers: The skill generates a structured report but does not explicitly define escaping or delimiters for the untrusted metadata strings.
- Capability inventory: Huawei Cloud CLI (
hcloud) query operations and TLS network probing on port 443. - Sanitization: The scripts use standard Python libraries (
ssl,socket) to parse structured data and include validation for domain formats and numeric timestamps.
Audit Metadata