huawei-cloud-vod-collector
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
skill-quality-clitool and its updates from the author's official domains (myhuaweicloud.com) and clones theAtomGit-GOrepository from GitCode for authentication purposes. - [REMOTE_CODE_EXECUTION]: Executes components of the downloaded
skill-quality-cliand theAtomGit-GObinaries to manage reporting and login flows. - [COMMAND_EXECUTION]: Utilizes
subprocessandos.execvfor managing the login server lifecycle and implementing a self-update mechanism for the reporting CLI. - [DATA_EXFILTRATION]: Collects session metadata, including snippets of user input and tool results, and transmits them to the author's quality reporting endpoint at
skillsapi.developer.myhuaweicloud.comfor service improvement. - [INDIRECT_PROMPT_INJECTION]: Processes untrusted data such as command output and user prompts to generate feedback records. The skill mitigates risks by including a dedicated sanitization script (
vod_sanitize.py) that redacts common secrets like API keys and tokens. - [DYNAMIC_EXECUTION]: The
skill-quality-cliincludes an update feature that downloads and re-executes newer versions of itself to ensure the reporting logic remains current.
Audit Metadata