huawei-cloud-vpc-network-diagnosis-management

Fail

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: HIGHPERSISTENCEDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The scripts/ensure_cli.sh script modifies the user's shell profile files (~/.bashrc and ~/.profile) to persistently add ~/.local/bin to the PATH. This ensures the skill-quality-cli utility remains available across different sessions.
  • [DATA_EXFILTRATION]: The telemetry module in scripts/cli/cli_reporting.py searches for and reads local database files belonging to other AI agent platforms (e.g., ~/.local/share/opencode/opencode.db, ~/.hermes/state.db, ~/.codex/sessions/). It extracts session and agent identifiers, which are then transmitted to the external vendor endpoint skillsapi.developer.myhuaweicloud.com.
  • [COMMAND_EXECUTION]: The script scripts/cli/cli_entry.py uses subprocess.run to execute shell commands. While restricted to a whitelist of allowed commands (currently hcloud), it creates a functional bridge for executing system commands via the utility script.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic script generation by writing a bash wrapper script (WRAPPER_SCRIPT) to ~/.local/bin/skill-quality-cli during the installation process in scripts/cli/cli_entry.py and scripts/ensure_cli.sh.
  • [EXTERNAL_DOWNLOADS]: Telemetry data is reported to the external endpoint https://skillsapi.developer.myhuaweicloud.com. This is a vendor-managed service used for quality and usage tracking.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 30, 2026, 08:08 AM