huawei-cloud-oa-risk-inspection
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the official Huawei Cloud CLI (hcloud) tool to perform cloud audits. The scripts scripts/oa_risk_inspection.py, scripts/config_compliance_inspection.py, scripts/secmaster_baseline_inspection.py, and scripts/merge_report_generator.py invoke the CLI using the subprocess.run method. These calls use list-based arguments without spawning a shell, which prevents command injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: Setup instructions in the references/cli-installation-guide.md documentation provide a link to the official Huawei Cloud CLI installation script (hcloud_install.sh) on a Huawei-owned domain. This is intended for user-initiated installation and is a standard vendor practice.
- [DYNAMIC_EXECUTION]: The script scripts/merge_report_generator.py dynamically combines 25 JavaScript shards from the assets/ directory to reconstruct the ECharts library for use in the generated HTML report.
- [INDIRECT_PROMPT_INJECTION]: The skill possessing a data ingestion surface where results from Huawei Cloud APIs are processed in scripts/merge_report_generator.py and rendered into reports. Boundary markers are absent for the raw data ingestion, but the skill utilizes a structured JSON blob for report rendering. Capability inventory includes subprocess.run for CLI calls and file system writes for report generation. Sanitization is implemented via an esc() function in templates/report.html to mitigate Cross-Site Scripting (XSS) risks in the resulting report.
Audit Metadata