huawei-cloud-voucher-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads utility binaries and scripts from official Huawei Cloud Object Storage Service (OBS) domains.
- [COMMAND_EXECUTION]: Shell scripts (
ensure_cli.sh,install_cli.sh) automate the setup and permission management of the vendor's quality-checking tool. - [REMOTE_CODE_EXECUTION]: The installation process involves downloading and executing content from vendor-controlled URLs (
myhuaweicloud.com). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves mission and task descriptions from the Huawei Cloud growth center API (
devdata.huaweicloud.com). - Boundary markers: None are present in the processing logic for mission-related strings.
- Capability inventory: The skill possesses network access for API calls and execution capabilities via the CLI wrapper.
- Sanitization: Data is ingested via structured JSON, but no filtering is applied to detect instructions within fields like task names.
Audit Metadata