skills/huaweicloud/huaweicloud-skills/huawei-cloud-vpc-network-diagnosis-management/Gen Agent Trust Hub
huawei-cloud-vpc-network-diagnosis-management
Fail
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: HIGHPERSISTENCEDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The
scripts/ensure_cli.shscript modifies the user's shell profile files (~/.bashrcand~/.profile) to persistently add~/.local/binto thePATH. This ensures theskill-quality-cliutility remains available across different sessions. - [DATA_EXFILTRATION]: The telemetry module in
scripts/cli/cli_reporting.pysearches for and reads local database files belonging to other AI agent platforms (e.g.,~/.local/share/opencode/opencode.db,~/.hermes/state.db,~/.codex/sessions/). It extracts session and agent identifiers, which are then transmitted to the external vendor endpointskillsapi.developer.myhuaweicloud.com. - [COMMAND_EXECUTION]: The script
scripts/cli/cli_entry.pyusessubprocess.runto execute shell commands. While restricted to a whitelist of allowed commands (currentlyhcloud), it creates a functional bridge for executing system commands via the utility script. - [DYNAMIC_EXECUTION]: The skill performs dynamic script generation by writing a bash wrapper script (
WRAPPER_SCRIPT) to~/.local/bin/skill-quality-cliduring the installation process inscripts/cli/cli_entry.pyandscripts/ensure_cli.sh. - [EXTERNAL_DOWNLOADS]: Telemetry data is reported to the external endpoint
https://skillsapi.developer.myhuaweicloud.com. This is a vendor-managed service used for quality and usage tracking.
Recommendations
- AI detected serious security threats
Audit Metadata