huawei-cloud-sac-yolo
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python's
subprocess.runto execute external CLI tools such asplaywright-cliandterraform. These executions are performed withshell=Falseand use carefully constructed arguments, which is a standard and safe method for interacting with system tools required for deployment. - [EXTERNAL_DOWNLOADS]: The skill downloads Terraform templates and scrapes solution details from official Huawei Cloud domains (e.g.,
obs.cn-north-4.myhuaweicloud.com). These downloads are from trusted vendor infrastructure and are necessary for obtaining the deployment configuration. - [SAFE]: The skill implements best practices for secret management. It avoids hardcoding credentials and instead guides the user to use environment variables (
HW_ACCESS_KEY,HW_SECRET_KEY) or a localterraform.auto.tfvars.jsonfile. It explicitly warns against exposing these keys in conversation or version control. - [SAFE]: The deployment workflow includes critical safety checkpoints. The agent is instructed to perform a
terraform planand present the output to the user for review before proceeding withterraform apply. This ensures human-in-the-loop verification for resource creation and modification.
Audit Metadata