huawei-cloud-cloudrobo-asset

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the hw-cloudrobo-client package via pip, which is the official Huawei Cloud CLI framework for this service.
  • [COMMAND_EXECUTION]: The skill includes a test script (scripts/test-cli-commands.sh) used for functional verification. This script executes cloudrobo CLI commands and small Python snippets to verify the SDK functionality. It includes a credential scanner that looks for HUAWEI_CLOUD_AK and HUAWEI_CLOUD_SK in environment variables solely to enable authenticated testing.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface in the import-asset command, which automatically parses YAML frontmatter from local README.md files. This is used to populate asset metadata (name, type, tags). The skill mitigates risks by employing a safe parser (_safe_parse_frontmatter) and performing strict client-side validation against predefined rules for ext_metadata and asset types before any API calls are made.
  • [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly instructs users to manage sensitive Access Keys (AK) and Secret Keys (SK) via environment variables or localized configuration files (~/.cloudrobo/config.yaml), following secret management best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 06:41 AM
Security Audit — agent-trust-hub — huawei-cloud-cloudrobo-asset