huawei-cloud-storage-query
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various methods to execute shell commands and system processes during its setup and operation.
- The
ensure_env.pyscript usessubprocess.runto manage virtual environments and install Python dependencies viapip. - On Linux systems,
ensure_env.pyattempts to executesudo apt installto obtain system-level dependencies likepython3-venv. - The skill uses
os.execv()inensure_env.pyto replace the current process with the virtual environment's Python interpreter. - [EXTERNAL_DOWNLOADS]: The environment preparation logic (
ensure_env.py) automatically downloads theget-pip.pyscript if thepippackage manager is missing. - Remote downloads are attempted from
bootstrap.pypa.ioand the vendor's mirror atmirrors.huaweicloud.com. - [COMMAND_EXECUTION]: The skill contains configurations that explicitly disable security protocols for network communications.
scripts/config.pyandscripts/ensure_env.pyboth configure the environment to ignore SSL certificate validation (ignore_ssl_verification = Trueandssl._create_unverified_context()). This practice prevents the validation of remote server identities and exposes API traffic to potential Man-in-the-Middle (MitM) attacks.
Audit Metadata