huawei-cloud-openviking-agent-integration
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill modifies system-level template files (
/root/template/<agent>/start.sh) and sandbox configuration files to inject integration logic and MCP server settings. - [EXTERNAL_DOWNLOADS]: Fetches dependencies from vendor-owned mirrors, including the Python MCP SDK from
mirrors.huaweicloud.com/repository/pypi/simpleand Node.js plugins frommirrors.huaweicloud.com/repository/npm/. These are legitimate vendor resources. - [DYNAMIC_EXECUTION]: The skill uses Python heredocs within shell scripts to dynamically generate and execute patching logic for JSON, YAML, and TOML configuration files at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where agents ingest data from the OpenViking memory system which could contain malicious instructions.
- Ingestion points: Tools such as
mcp__openviking__recall,mcp__openviking__search, andmcp__openviking__read(scripts/integrate.sh). - Boundary markers: None identified in the injected prompts or instructions.
- Capability inventory: Injected agents have access to memory retrieval, resource indexing, and their native file system/command execution capabilities.
- Sanitization: No explicit sanitization or filtering of retrieved memory content was found before interpolation into the agent's context.
Audit Metadata