huawei-cloud-iam-query
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The environment setup script (
scripts/ensure_env.py) executes system commands to manage virtual environments and install necessary Python dependencies. This includes invoking package managers such aspip,apt,yum,dnf, andbrew. It also utilizesos.execvto restart the script process within a newly created virtual environment. - [EXTERNAL_DOWNLOADS]: During environment preparation, the skill may download the
get-pip.pyutility from trusted sources likepypa.ioorhuaweicloud.com. It also accesses well-known repository mirrors (e.g., Tsinghua University, Aliyun) to install the required Huawei Cloud SDK packages. - [DATA_EXPOSURE]: The skill requires Huawei Cloud credentials (
HW_ACCESS_KEY,HW_SECRET_KEY) to be present in environment variables. The scripts access these credentials to authenticate API calls. TheSKILL.mdfile contains explicit instructions to prevent the agent from displaying these sensitive values to the user. - [SSL_VERIFICATION_DISABLED]: The configuration script (
scripts/config.py) and setup script (scripts/ensure_env.py) disable SSL certificate verification (ignore_ssl_verification = Trueandssl._create_unverified_context()). This is intended to avoid connectivity issues in restricted network environments but reduces protection against man-in-the-middle attacks.
Audit Metadata