Skills
Navigate
skills/huaweicloud/huaweicloud-skills/huawei-cloud-devbridge-tunnel/Gen Agent Trust Hub

huawei-cloud-devbridge-tunnel

Fail

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script from https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh. This source is a verified vendor domain for Huawei Cloud.
  • [DYNAMIC_EXECUTION]: The script scripts/devbridge_cmd.sh employs the eval command to execute shell strings that are dynamically assembled or modified at runtime, including using complex string substitutions to recover from CLI errors.
  • [COMMAND_EXECUTION]: User-provided parameters such as tunnel names and descriptions are interpolated into shell command strings within scripts/devbridge_cmd.sh and subsequently executed using eval. This creates a vulnerability to command injection if a user provides input containing shell metacharacters.
Recommendations
  • HIGH: Downloads and executes remote code from: https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 14, 2026, 02:44 AM