huawei-cloud-cloudrobo-asset
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
hw-cloudrobo-clientpackage via pip, which is the official Huawei Cloud CLI framework for this service. - [COMMAND_EXECUTION]: The skill includes a test script (
scripts/test-cli-commands.sh) used for functional verification. This script executescloudroboCLI commands and small Python snippets to verify the SDK functionality. It includes a credential scanner that looks forHUAWEI_CLOUD_AKandHUAWEI_CLOUD_SKin environment variables solely to enable authenticated testing. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface in the
import-assetcommand, which automatically parses YAML frontmatter from localREADME.mdfiles. This is used to populate asset metadata (name, type, tags). The skill mitigates risks by employing a safe parser (_safe_parse_frontmatter) and performing strict client-side validation against predefined rules forext_metadataand asset types before any API calls are made. - [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly instructs users to manage sensitive Access Keys (AK) and Secret Keys (SK) via environment variables or localized configuration files (
~/.cloudrobo/config.yaml), following secret management best practices.
Audit Metadata