huawei-cloud-obs-website-host

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads official CLI utilities (hcloud and obsutil) and installation scripts directly from Huawei Cloud's verified Object Storage Service domains.
  • Evidence: references/cli-installation-guide.md contains download links targeting *.myhuaweicloud.com for platform-specific binaries and installers.
  • [REMOTE_CODE_EXECUTION]: Includes instructions for the installation of the Huawei Cloud CLI using a remote script.
  • Evidence: references/cli-installation-guide.md provides a command to fetch hcloud_install.sh and execute it using bash. This is the standard, official installation method for the vendor's tooling.
  • [COMMAND_EXECUTION]: Utilizes bundled Python scripts to interact with the Huawei Cloud OBS SDK for resource configuration.
  • Evidence: scripts/set_obs_website_sdk.py and scripts/verify_obs_website.py perform SDK calls to setBucketWebsite and setBucketCustomDomain to manage bucket settings.
  • [DATA_EXFILTRATION]: Reads local configuration files (.obsutilconfig) to authenticate with cloud services.
  • Evidence: The skill accesses ~/.obsutilconfig to check for the presence of Access Keys (AK) and Secret Keys (SK). It employs specific safety logic using awk and PowerShell to verify that these credentials exist without ever outputting the secret values to the agent's context or logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:37 PM