huawei-cloud-obs-stats

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/obs_traffic_stats.py and scripts/obs_request_stats.py to invoke the Huawei Cloud CLI (hcloud).
  • Evidence: The scripts construct command arrays for querying monitoring data (e.g., ['hcloud', 'CES', 'ShowMetricData', ... ]) and execute them using subprocess.run(cmd, capture_output=True, text=True).
  • Context: These executions are used for the primary purpose of the skill (fetching stats) and follow safe practices by passing arguments as a list rather than a single shell string.
  • [SAFE]: The skill includes strong security guardrails regarding credentials.
  • Evidence: SKILL.md contains explicit instructions to never ask for or accept AK/SK keys in plaintext and directs users to local configuration methods (hcloud configure or environment variables).
  • [SAFE]: The skill implements strict functional constraints to prevent misuse.
  • Evidence: A 'Prohibited Operations' section in SKILL.md explicitly forbids DeleteBucket, DeleteObject, and other destructive commands, instructing the agent to refuse such requests.
  • [SAFE]: All external downloads and references target official Huawei Cloud documentation and tool repositories.
  • Evidence: Download URLs in references/cli-installation-guide.md point to obs-community-tool.obs.cn-north-1.myhuaweicloud.com, which is the vendor's official domain for CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 09:10 AM
Security Audit — agent-trust-hub — huawei-cloud-obs-stats