pudu-cloudveil-skill
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust authentication workflow using SSO and SM2 encryption. The encryption is performed by a bundled Node.js script and WebAssembly module (scripts/sm2encrypt/), which is executed locally using execFile with parameters provided via environment variables, ensuring credentials are never exposed in plaintext within the skill files.
- [SAFE]: Parameter normalization and validation are enforced in the SKILL.md instructions. The agent is directed to map user-provided fields to a whitelist of official fields defined in the assets/*.openapi.json schemas, which serves as a safeguard against command or parameter injection during API interaction.
- [SAFE]: Network operations are restricted to the user-configured CLOUDVEIL_BASE_URL and official Pudu Technology documentation domains (open.pudutech.com). All network interactions are handled through a dedicated request script (scripts/cloudveil-request.js) that includes response verification (checking for HTTP 200 and business logic SUCCESS status).
Audit Metadata