huawei-cloud-lts-log-inspector

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the official KooCLI (hcloud) installation script from a Huawei Cloud OBS domain in references/cli-installation-guide.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted log data which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Data from ListLogs and ListLogContext (defined in SKILL.md) is read into the agent's context.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the log content as untrusted data.
  • Capability inventory: The agent has the capability to execute shell commands via the hcloud CLI and manage OBS transfers.
  • Sanitization: There is no evidence of sanitization or filtering of the log content before it is processed.
  • [COMMAND_EXECUTION]: Extensive use of the hcloud CLI to interact with Huawei Cloud services, including querying logs, managing host groups, and creating OBS transfers.
  • [DYNAMIC_EXECUTION]: The script scripts/test-cli-commands.sh uses the eval command to execute shell strings constructed from the templates/test-defaults.json configuration file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 08:53 AM
Security Audit — agent-trust-hub — huawei-cloud-lts-log-inspector