huawei-cloud-ecs-sqlbot-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to prompt for or parse AK/SK from the user (including conversation input), shows CLI examples that embed keys as arguments, and outputs plaintext passwords—requiring the LLM to handle and potentially emit secret values verbatim, which is high-risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill creates and submits a COC shell script that, at runtime, downloads and executes the remote installer https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/quickly_implement_intelligent_data_queries_based_on_sqlbot/userdata/install-sqlbot.sh, which is remote code execution controlled by that URL.