huawei-cloud-obs-stats

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts (obs_request_stats.py and obs_traffic_stats.py) to execute the hcloud and obsutil CLI tools via the subprocess.run method. Commands are constructed using a list of arguments, which is a standard best practice to mitigate shell injection risks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from external CLI commands and cloud monitoring data, such as bucket names and traffic statistics. This data is ingested from the external cloud environment into the agent context. While the scripts parse JSON output, they do not utilize specific prompt boundary markers when displaying this information back to the user.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and links to download the Huawei Cloud CLI (hcloud) and obsutil tools. These downloads target official vendor-owned domains (e.g., myhuaweicloud.com), which are verified as safe for the intended administrative purpose.
  • [SAFE]: The skill incorporates robust security constraints, including strict prohibitions on destructive operations like deleting buckets or objects. It also enforces secure authentication practices by instructing users to configure credentials via environment variables or CLI configuration files rather than providing them in plain text within the conversation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 01:31 PM