huawei-cloud-flexus-l-server-flexusagent-deployment

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads maintenance and deployment scripts from official Huawei Cloud Object Storage (OBS) and executes them via shell pipes on target cloud instances. This is used for tasks such as resetting administrator passwords and importing workflows.
  • Evidence: scripts/lib.py contains SCRIPT_TEMPLATES with commands piping curl output to bash for script execution from *.myhuaweicloud.com domains.
  • [DYNAMIC_EXECUTION]: The skill dynamically constructs shell script payloads by interpolating user-provided credentials and remote template data into command strings. These scripts are then transmitted to Huawei Cloud's Cloud Operations Center (COC) for execution on target instances.
  • Evidence: scripts/lib.py and scripts/app_workflow_import.py use string replacement and base64 encoding to build execution payloads for remote COC commands.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests workflow data and templates from remote vendor repositories which are then processed and used as payloads for remote operations.
  • Ingestion points: scripts/app_workflow_import.py fetches workflow indices and YAML templates from Huawei Cloud OBS.
  • Boundary markers: Absent. Data is retrieved and directly processed into execution payloads.
  • Capability inventory: Remote script execution and instance management via COC and HCSS APIs.
  • Sanitization: Basic removal of control characters in scripts/lib.py before base64 encoding the payload for remote execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 04:14 PM