huawei-cloud-modelarts-training-diagnosis
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Huawei Cloud KooCLI (hcloud) installation script and binaries from official Huawei Cloud Object Storage Service (OBS) domains (*.myhuaweicloud.com). This is a standard procedure for installing vendor-provided development tools.
- [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute the official Huawei Cloud installation script using 'curl | bash'. While this is a high-privilege execution pattern, the source is verified as the vendor's official distribution channel.
- [COMMAND_EXECUTION]: Executes the 'hcloud' CLI tool to interact with ModelArts APIs. The skill follows standard CLI conventions, including PascalCase for operations and JSON for structured output processing.
- [DATA_EXFILTRATION]: Interacts with authentication configuration via 'hcloud configure list'. The skill instructions explicitly mandate the masking of sensitive information (e.g., tokens, IP addresses) and emphasize extracting only relevant traceback lines from logs to prevent unnecessary data exposure.
- [PROMPT_INJECTION]: Evaluates an attack surface for indirect prompt injection via training logs and tracebacks. The skill mitigates this by enforcing an evidence-based reasoning workflow, requiring all findings to be linked to specific API fields, and providing strict Markdown templates for output to prevent instruction leakage.
Audit Metadata