huawei-cloud-cost-estimation
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a CLI installation guide that directs users to download the
hcloudbinary from a Huawei Cloud S3 bucket (myhuaweicloud.com). This is a legitimate vendor resource used to facilitate the skill's primary function. - [COMMAND_EXECUTION]: The skill's operation is centered on executing
hcloudCLI commands. Provisioning actions are strictly governed by an allowlist of 74 operations and follow a multi-step safety protocol (Help -> Resolve -> Cost -> Dry-run -> Confirm -> Execute) to prevent unauthorized or accidental resource creation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external command outputs (BSS pricing APIs). While this constitutes an attack surface, the risk is mitigated by specific instructions to parse exact fields from JSON output, perform schema validation via the
--helpcommand, and maintain strict boundary markers for execution.
Audit Metadata