skills/huaweicloud/huaweicloud-skills/huawei-cloud-ucs-cluster-onboarding-manager/Gen Agent Trust Hub
huawei-cloud-ucs-cluster-onboarding-manager
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Huawei Cloud KooCLI (hcloud) installation script from an official vendor domain (obs.cn-north-4.myhuaweicloud.com). This is a standard setup procedure for the vendor's toolset.
- [REMOTE_CODE_EXECUTION]: The CLI installation guide includes a pattern to download and execute a shell script using
curlandbash. Since the source is a verified vendor repository (huaweicloud), this is considered a safe and intended operational step. - [COMMAND_EXECUTION]: The skill uses the
hcloudcommand-line interface to interact with cloud APIs. It includes an automated acceptance of privacy terms usingprintf "y\n" | hcloud version, which is a common automation pattern for CLI tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including Kubernetes cluster metadata, annotations, and kubeconfig content when registering clusters.
- Ingestion points: Cluster registration parameters in
task-cluster-registration.mdandSKILL.mdspecificallymetadata.nameandmetadata.annotations.kubeconfig. - Boundary markers: None identified for individual parameter inputs.
- Capability inventory: The skill can create, update, and delete cloud resources and retrieve sensitive kubeconfig files via the
hcloudCLI. - Sanitization: The skill relies on the underlying cloud provider's API and CLI validation to handle input data. Potential risks are mitigated by the requirement for explicit user confirmation before executing billing-related or destructive actions.
Audit Metadata