huawei-cloud-ecs-vulnerability-auditor
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Huawei Cloud KooCLI (hcloud) installation script from the vendor's official Object Storage Service (OBS) domains.
- [COMMAND_EXECUTION]: Conducts remote inventory discovery by executing shell scripts on target ECS instances via the Huawei Cloud Cloud Operations Center (COC) platform.
- [PRIVILEGE_ESCALATION]: Recommends the creation of a cross-service IAM Agency (ServiceAgencyForCOC) to grant the COC service the necessary permissions to manage and execute code on ECS instances.
- [DATA_EXFILTRATION]: Transmits the names and versions of discovered software components to an external third-party API (db.gcve.eu) to retrieve vulnerability metadata.
- [INDIRECT_PROMPT_INJECTION]: Processes execution logs from remote servers and JSON responses from an external API to drive logic for version matching and report generation.
- Ingestion points: Reads remote logs via the 'hcloud COC GetScriptJobBatch' command and vulnerability intelligence from 'https://db.gcve.eu/api/'.
- Boundary markers: Uses explicit delimiters (===ECS_ASSET_INVENTORY_START===) to isolate asset data within log streams.
- Capability inventory: Employs hcloud for cloud orchestration and local Python scripts for data processing and Markdown report rendering.
- Sanitization: Relies on standard JSON parsing (json.loads) for input handling; no dynamic execution of strings received from external sources was detected.
Audit Metadata