huawei-cloud-dli-manage
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the official Huawei Cloud KooCLI (
hcloud) installer from the vendor's Object Storage Service (OBS) repository. - [COMMAND_EXECUTION]: The
scripts/dli_manage.pyscript acts as a wrapper for thehcloud dliCLI tool, executing various resource management operations through the Pythonsubprocessmodule. High-risk operations (e.g., deletion, scaling) are gated by a manual confirmation requirement. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources that could potentially contain malicious instructions, such as DLI SQL/Spark job logs and table contents during preview operations.
- Ingestion points: Operations like
ShowSqlJobDetail,ShowSparkJobLog, andPreviewTablefetch logs and data directly from the cloud-side DLI service. - Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" wrappers for content retrieved from the cloud service.
- Capability inventory: The skill includes the ability to perform destructive actions such as
DeleteTable,DeleteQueue, andCancelSqlJobvia the CLI wrapper. - Sanitization: There is no evidence of filtering or escaping logic applied to the DLI service outputs before they are presented to the agent context.
- [DATA_EXPOSURE]: The skill incorporates an official vendor SDK (
scripts/skill_quality_sdk.py) that reports execution metrics, including masked input parameters and output results, to a Huawei Cloud quality reporting API endpoint.
Audit Metadata