huawei-cloud-vod-collector

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the skill-quality-cli tool and its updates from the author's official domains (myhuaweicloud.com) and clones the AtomGit-GO repository from GitCode for authentication purposes.
  • [REMOTE_CODE_EXECUTION]: Executes components of the downloaded skill-quality-cli and the AtomGit-GO binaries to manage reporting and login flows.
  • [COMMAND_EXECUTION]: Utilizes subprocess and os.execv for managing the login server lifecycle and implementing a self-update mechanism for the reporting CLI.
  • [DATA_EXFILTRATION]: Collects session metadata, including snippets of user input and tool results, and transmits them to the author's quality reporting endpoint at skillsapi.developer.myhuaweicloud.com for service improvement.
  • [INDIRECT_PROMPT_INJECTION]: Processes untrusted data such as command output and user prompts to generate feedback records. The skill mitigates risks by including a dedicated sanitization script (vod_sanitize.py) that redacts common secrets like API keys and tokens.
  • [DYNAMIC_EXECUTION]: The skill-quality-cli includes an update feature that downloads and re-executes newer versions of itself to ensure the reporting logic remains current.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 01:12 PM