huawei-cloud-cloudrobo-resource
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions and verification scripts rely on the execution of the
cloudroboCLI to interact with cloud services. - Evidence: Core command definitions in
SKILL.mdand functional tests inscripts/test-cli-commands.shinvoke thecloudrobo resourcecommand group. - [EXTERNAL_DOWNLOADS]: The skill documentation guides the user to install the
hw-cloudrobo-clientpackage, which is an official resource provided by the vendor. - Evidence:
references/cli-installation-guide.mdprovides installation instructions for thehw-cloudrobo-clientpackage via pip. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data retrieved from cloud APIs (such as resource names, node labels, and descriptions) which could be used as an injection vector if the cloud environment is compromised.
- Ingestion points: Output from
list-quotas,list-pools, andshow-poolcommands as described inSKILL.md. - Boundary markers: Absent; the agent is expected to process the raw output from CLI/SDK calls.
- Capability inventory: The skill utilizes subprocess execution for the CLI and Python environment for the SDK.
- Sanitization: Absent; the skill does not explicitly describe sanitization of the cloud-provided metadata before presentation to the agent.
- [DYNAMIC_EXECUTION]: The provided functional test script generates and runs short Python scripts to verify SDK behavior at runtime.
- Evidence:
scripts/test-cli-commands.shusespython3 -cto dynamically execute code snippets that instantiate theResourceClientand call its methods.
Audit Metadata