huawei-cloud-cli-guidance

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit-parameter examples and instructions to guide users to input AK/SK and to construct commands like --cli-access-key --cli-secret-key , which would require the LLM to accept and/or emit secret values verbatim (an explicit high-risk pattern).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation steps explicitly download and execute a remote installer (curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh), so the URL is fetched at runtime and runs remote code required by the skill.