huawei-cloud-lts-manage

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and executes the official Huawei Cloud CLI installation script.
  • Evidence: references/cli-installation-guide.md contains a command to download hcloud_install.sh from https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh and execute it via bash. The domain is an official Huawei Cloud Object Storage Service (OBS) endpoint.
  • [COMMAND_EXECUTION]: The primary function of the skill is to execute shell commands via the hcloud CLI to manage cloud resources.
  • Evidence: SKILL.md defines numerous commands for querying, creating, updating, and deleting log groups, streams, and alarms (e.g., hcloud LTS ListLogGroups, hcloud LTS CreateTransfer).
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves log data which acts as untrusted external content that could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Untrusted log data enters the agent context through the hcloud LTS ListLogs and hcloud LTS ListQueryStructuredLogs commands as documented in SKILL.md.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded instructions are present in the prompt templates.
  • Capability inventory: The agent has the capability to execute shell commands (hcloud CLI) and perform file system operations as described across all reference files.
  • Sanitization: No sanitization, escaping, or filtering of the retrieved log content is specified before the data is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 04:19 PM