huawei-cloud-cloudrobo-data-pipeline

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the subprocess module to manage its local monitoring server and perform diagnostic pre-flight checks. These operations are restricted to executing the Python interpreter with internal scripts and fixed arguments, avoiding shell injection risks.
  • [INDIRECT_PROMPT_INJECTION]: The skill's web monitoring component retrieves and displays task logs from the CloudRobo platform. To mitigate the risk of processing malicious instructions that might be embedded in logs, the skill implements robust HTML escaping and a dedicated secret-masking regular expression that redacts sensitive keys such as access keys, tokens, and passwords.
  • [DATA_EXFILTRATION]: While the skill manages cloud tasks and data assets, it only communicates with established Huawei Cloud service domains. All sensitive operations, such as asset registration and task creation, require explicit user confirmation of the execution plan, and no data is sent to non-whitelisted or untrusted external destinations.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 02:16 PM