huawei-cloud-ecs-dsh-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The deployment process downloads Node.js binaries and the
@deepseek-ai/dshpackage. These downloads target official project sites (nodejs.org) and established, well-known mirrors for the region (npmmirror.com, ustc.edu.cn), ensuring the integrity of the installation components. - [COMMAND_EXECUTION]: The utility script
scripts/utils.pyusessubprocess.runto manage the local environment, such as installing missing Python SDK dependencies viapipand sending status notifications through theopenclawCLI if configured by the user. - [DYNAMIC_EXECUTION]: The skill utilizes
importlib.import_moduleinscripts/utils.pyto verify the presence of required Huawei Cloud SDK modules at runtime, allowing the skill to validate its execution environment before attempting resource creation. - [REMOTE_CODE_EXECUTION]: The skill automates server provisioning by executing a predefined bash script on the target instance using the Huawei Cloud Cloud Operations Center (COC). This script performs system configuration, user creation, and service installation within the user's cloud environment.
- [CREDENTIALS_SAFE]: DeepSeek API keys and Huawei Cloud AK/SK credentials are handled securely. Cloud credentials are fetched from environment variables or command-line arguments, while the DeepSeek API key is stored on the server using a systemd drop-in file with restricted permissions (mode 600) to prevent unauthorized access.
Audit Metadata