cloud-api-operations
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches API documentation, index files, and SDK schema definitions from official Tencent Cloud domains (cloud.tencent.com, docs.cloudbase.net) and their verified source code repositories on GitHub (github.com/TencentCloud), Gitee, and CNB. These resources are used for API action and parameter validation.
- [COMMAND_EXECUTION]: Utilizes platform-provided tools
authandcallCloudApito manage environment credentials and perform cloud resource operations. It specifically includes a flow to retrieve temporary credentials for use in user scripts. - [INDIRECT_PROMPT_INJECTION]: The agent is instructed to ingest and parse external content, including the API reference index and SDK source files. This creates a vulnerability surface where malformed or malicious content in these external sources could attempt to influence the agent's behavior.
- Ingestion points: SKILL.md (Workflow Step 1) and references/calling-methods.md (§2) describe fetching data from docs.cloudbase.net and TencentCloud's GitHub/CNB/Gitee repositories.
- Boundary markers: None explicitly defined in the provided instructions for these ingestion points.
- Capability inventory: The agent has access to
callCloudApifor control-plane operations andauthfor credential retrieval. - Sanitization: No specific sanitization or filtering logic is described for the ingested documentation or source code.
Audit Metadata