huawei-cloud-solution-ops
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by 'huaweicloud' and exclusively utilizes official Huawei Cloud resources, including KooCLI, official SDKs, and Terraform providers. All external documentation links target official Huawei Cloud domains.
- [CREDENTIALS_SAFE]: The skill incorporates clear instructions to avoid hardcoding or logging sensitive credentials (AK/SK, API keys, passwords). It mandates the use of environment variables, local profiles, and secure variable injection for Terraform, adhering to security best practices.
- [COMMAND_EXECUTION]: A bundled launcher (
bin/hcloud-skill) allows for the execution of internal Python scripts. This launcher implements a regular expression check (^[A-Za-z0-9][A-Za-z0-9_.-]*$) on script names to prevent path traversal or the execution of unauthorized files. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from cloud API responses and local task files. It mitigates potential indirect prompt injection by instructing the agent to use structured input (
--cli-jsonInput), perform pre-flight validation, and verify operational outcomes through multiple evidence layers rather than relying solely on API success messages.
Audit Metadata