huawei-cloud-mrs-host-fault-diagnose
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from cluster logs and API responses. It mitigates injection risks by using structured data formats (JSON), strict parameter validation (regex and type checking defined in YAML configurations), and a design that focuses on information gathering rather than command generation from log content.
- [COMMAND_EXECUTION]: The Python scripts use
subprocess.runfor legitimate administrative tasks, specifically calling a local Huawei security binary (CryptoAPI) for password encryption/decryption and identifying the host operating system. All parameters passed to these calls are internally controlled and validated. - [SAFE]: All diagnostic operations described in the markdown workflows and implemented in the API configurations are for data collection (GET requests or search operations). The skill explicitly prohibits modifying or deleting cluster resources, ensuring a read-only execution environment.
Audit Metadata