huawei-cloud-obs-lifecycle-management
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's setup scripts (scripts/ensure_cli.sh) download a quality monitoring utility from the vendor's official OBS repository at obs-skills-repository.obs.cn-north-4.myhuaweicloud.com.
- [COMMAND_EXECUTION]: All hcloud CLI operations are executed through secure subprocess calls in scripts/obs_lifecycle_analyzer.py using list-based argument construction, which mitigates shell injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of object keys and metadata listed from storage buckets. While the skill lacks explicit boundary markers for this data, it handles these inputs as plain strings for logic and display, with no observed execution or evaluation sinks.
- [DATA_EXFILTRATION]: Command execution telemetry is sent to the vendor's API at skillsapi.developer.myhuaweicloud.com. This behavior is documented as part of the skill's quality assurance and provides an opt-out mechanism via environment variables.
Audit Metadata