skills/huaweicloud/huaweicloud-skills/huawei-cloud-flexus-l-server-flexusagent-deployment/Gen Agent Trust Hub
huawei-cloud-flexus-l-server-flexusagent-deployment
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads maintenance and deployment scripts from official Huawei Cloud Object Storage (OBS) and executes them via shell pipes on target cloud instances. This is used for tasks such as resetting administrator passwords and importing workflows.
- Evidence:
scripts/lib.pycontainsSCRIPT_TEMPLATESwith commands pipingcurloutput tobashfor script execution from*.myhuaweicloud.comdomains. - [DYNAMIC_EXECUTION]: The skill dynamically constructs shell script payloads by interpolating user-provided credentials and remote template data into command strings. These scripts are then transmitted to Huawei Cloud's Cloud Operations Center (COC) for execution on target instances.
- Evidence:
scripts/lib.pyandscripts/app_workflow_import.pyuse string replacement and base64 encoding to build execution payloads for remote COC commands. - [INDIRECT_PROMPT_INJECTION]: The skill ingests workflow data and templates from remote vendor repositories which are then processed and used as payloads for remote operations.
- Ingestion points:
scripts/app_workflow_import.pyfetches workflow indices and YAML templates from Huawei Cloud OBS. - Boundary markers: Absent. Data is retrieved and directly processed into execution payloads.
- Capability inventory: Remote script execution and instance management via COC and HCSS APIs.
- Sanitization: Basic removal of control characters in
scripts/lib.pybefore base64 encoding the payload for remote execution.
Audit Metadata