huawei-cloud-find-skills
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation (SKILL.md) and configuration data from Huawei Cloud's official GitHub organization repositories via
raw.githubusercontent.com. This is a legitimate functional requirement for a discovery tool to provide up-to-date information on available skills. - [COMMAND_EXECUTION]: The skill executes local search scripts (
scripts/search-skills.shandscripts/search-skills.ps1) to parse the included index. These scripts handle user-supplied search keywords safely by utilizing standard JSON processing utilities such asjqin Bash andConvertFrom-Jsonin PowerShell, preventing common command injection vectors. - [REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to install additional components using
npxfor theskillsandclawhubpackages. These operations target the vendor's own official repositories on GitHub and GitCode to provision specific agent capabilities requested by the user, which is consistent with the skill's primary purpose.
Audit Metadata