huawei-cloud-flexus-l-server-manage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow fetches and parses public API documentation pages via python urllib to extract specifications and images, which falls under fetching arbitrary web pages (low risk).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill manages Huawei Cloud Flexus L server lifecycle operations, specifically purchasing/creating instances, renewing subscriptions, and unsubscribing/canceling subscriptions via create-instance, renewal, and unsubscribe commands which interact with Huawei Cloud's BSS (Billing and Subscription) API. These represent direct financial operations (purchases and charges). Access is authenticated via Huawei Cloud Access Keys (AK/SK) and security tokens passed through environment variables or command-line parameters and validated by the Huawei Cloud service layer (independent service authentication), qualifying it for medium severity.