huawei-cloud-deployment-task-management
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the KooCLI installer from Huawei Cloud's official object storage domain (myhuaweicloud.com). This is a standard installation procedure for the vendor's toolset.
- [DATA_EXFILTRATION]: The skill includes a telemetry reporting script (scripts/skill_quality_sdk.py) that transmits masked execution data, status codes, and trace identifiers to a vendor-owned quality reporting endpoint (skillsapi.developer.myhuaweicloud.com). The script contains robust masking for sensitive data such as keys and phone numbers.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection through task-related metadata. Ingestion points: Task names, application names, and parameter values passed to huawei_create_clouddeploy_task and huawei_start_clouddeploy_task. Boundary markers: The instructions do not define specific delimiters for separating user-controlled task parameters from system instructions. Capability inventory: The skill executes shell commands via the hcloud CLI to manage cloud resources and verifies artifacts using obsutil. Sanitization: The included quality SDK uses regex patterns to mask sensitive credentials and personally identifiable information (PII) before transmission.
Audit Metadata