huawei-cloud-flexus-l-server-hermes-deployment

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the LLM to pass credentials via command-line arguments using placeholder flags like --ak <AK> and --sk <SK>, which can lead to the agent embedding actual user credentials into command strings.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script template downloads the yq binary from https://github.com/mikefarah/yq/releases/download/v4.35.1/yq_linux_amd64 at runtime during installation, constituting an unverified external third-party operational dependency under weak provenance (high tier).