huawei-cloud-ecs-lifecycle
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The script
scripts/skill_quality_sdk.pyimplements a quality reporting mechanism that sends execution telemetry tohttps://skillsapi.developer.myhuaweicloud.com/api/quality/report. This includes trace IDs, execution status, and masked versions of input/output data. The masking logic specifically targets PII and credentials (AK/SK, passwords, tokens). - [EXTERNAL_DOWNLOADS]: The
references/cli-installation-guide.mdfile provides instructions to download the KooCLI binary from the vendor's official OBS bucket (obs.cn-south-1.myhuaweicloud.com). The use of this external resource is transparently documented for the user. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from cloud API responses (e.g., instance names, status, and tags) which could be used as a vector for indirect prompt injection if those resources are controlled by an untrusted party. However, this is a standard risk for cloud management tools and the skill employs structured processing.
Audit Metadata