huawei-cloud-migration-windows-ecs

Warn

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download migration components, such as the SMS Agent and AutoIt v3, from Huawei Cloud Object Storage (OBS). These files are then executed on the target Windows system to facilitate the migration.
  • [COMMAND_EXECUTION]: The orchestration logic relies on extensive command execution through multiple channels:
  • Local execution of the Huawei Cloud CLI (hcloud) and OBS utility (obsutil) to manage cloud resources.
  • Remote execution on target Windows hosts via WinRM to install software, manage processes, and clean up environments.
  • Remote execution on Linux proxy servers via SSH to set up tunnel (gost) and caching (Squid) services.
  • [DYNAMIC_EXECUTION]: The skill includes pre-compiled Windows executables (configure_sms_agent.exe and agent_config.exe) in the scripts/ directory. These binaries are transferred to and executed on the target migration hosts. While corresponding source code is provided in the repository, the use of pre-compiled binaries represents a significant execution surface.
  • [PERSISTENCE]: Automated recovery and configuration persistence are achieved by creating Windows Scheduled Tasks (ConfigureSMSAgent, SMSAgentWatchdog) and Linux systemd units (gost-proxyopt.service). These ensure the migration agent remains active and the network tunnel is restored upon reboot.
  • [PRIVILEGE_ESCALATION]: The migration process requires administrative access on target hosts. It uses commands to create tasks with highest execution levels (/rl highest), stop system services, and modify registry keys associated with software uninstallation and auto-start mechanisms.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 4, 2026, 02:15 PM