huawei-cloud-dws-spec-planner
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data such as project names, scenario types, and cluster specifications to perform calculations and generate structured reports. This creates an attack surface where malicious instructions embedded in survey responses could attempt to influence the agent's logic.
- Ingestion points: Survey parameters collected in Phase 1 (Requirement Survey) and Phase 6 (Report Output) as defined in
SKILL.md. - Boundary markers: Input is structured via tables and specific survey questions to reduce ambiguity.
- Capability inventory: The skill can generate Excel files and Markdown reports using Python scripts.
- Sanitization: User-provided strings are interpolated into calculation logic and reports without explicit sanitization or escaping.
- [EXTERNAL_DOWNLOADS]: The skill provides a guide for installing CLI tools (
hcloudandobsutil) by downloading binaries from official Huawei Cloud storage endpoints (obs-community-tool.obs.cn-north-1.myhuaweicloud.com). These downloads are from a recognized vendor and are intended for the skill's operation.
Audit Metadata