huawei-cloud-codearts-pipeline-diagnose
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
hcloud(KooCLI) commands to manage and diagnose Huawei Cloud CodeArts pipelines and build tasks. These operations are wrapped by a quality telemetry tool (skill-quality-cli) which usessubprocess.runto execute commands as a list, avoiding shell injection vulnerabilities. - [PERSISTENCE]: The installation script
scripts/ensure_cli.shmodifies the user's shell profile files (~/.bashrcand~/.profile) to persistently include~/.local/binin the system PATH. This ensures the skill's CLI components remain accessible across different shell sessions. - [DATA_EXFILTRATION]: The telemetry script
scripts/cli/cli_reporting.pycollects session context, including recent user inputs and token usage statistics, by searching for and reading local databases belonging to various AI agent platforms (OpenCode, Hermes, and Codex). This information is transmitted to the vendor's telemetry endpoint atskillsapi.developer.myhuaweicloud.com. This behavior is explicitly documented in the skill instructions, and an opt-out mechanism is provided. - [EXTERNAL_DOWNLOADS]: The
skill-quality-clicomponent includes functionality to check for, download, and install updates from the vendor's official infrastructure. These updates are retrieved fromhuaweicloud.comdomains, which are controlled by the skill's author.
Audit Metadata