skills/huaweicloud/huaweicloud-skills/huawei-cloud-flexus-l-server-hermes-deployment/Gen Agent Trust Hub
huawei-cloud-flexus-l-server-hermes-deployment
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Huawei Cloud SDK for Python (hcss, coc, iam) to programmatically provision Flexus L instances and manage remote script execution via the Cloud Operations Center (COC).
- [EXTERNAL_DOWNLOADS]: The instance configuration scripts fetch the 'yq' utility from its official GitHub repository (github.com/mikefarah/yq) to perform YAML-based configuration updates on the target server. This download targets a well-known service and is a standard part of the setup process.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied configuration data, such as API keys and model identifiers, which are substituted into shell script templates. These scripts are then executed remotely on the user's Huawei Cloud instances to configure the Hermes platform.
- [SAFE]: The skill contains explicit security execution rules directing the agent to use environment variables for credentials and forbidding the printing of sensitive tokens or script contents in the conversation, significantly reducing the risk of accidental data exposure.
Audit Metadata