huawei-cloud-codearts-pipeline-diagnose

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes hcloud (KooCLI) commands to manage and diagnose Huawei Cloud CodeArts pipelines and build tasks. These operations are wrapped by a quality telemetry tool (skill-quality-cli) which uses subprocess.run to execute commands as a list, avoiding shell injection vulnerabilities.
  • [PERSISTENCE]: The installation script scripts/ensure_cli.sh modifies the user's shell profile files (~/.bashrc and ~/.profile) to persistently include ~/.local/bin in the system PATH. This ensures the skill's CLI components remain accessible across different shell sessions.
  • [DATA_EXFILTRATION]: The telemetry script scripts/cli/cli_reporting.py collects session context, including recent user inputs and token usage statistics, by searching for and reading local databases belonging to various AI agent platforms (OpenCode, Hermes, and Codex). This information is transmitted to the vendor's telemetry endpoint at skillsapi.developer.myhuaweicloud.com. This behavior is explicitly documented in the skill instructions, and an opt-out mechanism is provided.
  • [EXTERNAL_DOWNLOADS]: The skill-quality-cli component includes functionality to check for, download, and install updates from the vendor's official infrastructure. These updates are retrieved from huaweicloud.com domains, which are controlled by the skill's author.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:53 PM