Security audit
Security checks for vulnerabilities and agentic risk
This skill is a real Huawei Cloud GES/OBS operator with credential use and destructive cloud actions, but its safeguards and transport security are not strong enough for automatic agent use.
Install only if you intend to let an agent operate a Huawei Cloud GES graph with scoped test credentials. Avoid production credentials unless the skill is revised to enforce TLS verification, use HTTPS for GES, require explicit confirmations or force flags for destructive actions, and restrict OBS operations to approved buckets and prefixes.
}
}
resp = requests.post(url, headers=headers, json=data, timeout=30, verify=False)
if resp.status_code not in [200, 201]:
raise Exception(f"密码获取Token失败: {resp.status_code}, {resp.text[:200]}")if self.token and current_time < self.token_expiry - 300:
return self.token
env_token = os.environ.get('GES_TOKEN')
if env_token:
self.token = env_token
self.token_expiry = time.time() + 3600 * 23edge_path="obs://bucket/edge"
)
# Export graph data (access_key/secret_key are read from .env automatically)
job_id = skill.client.export_graph(
export_path="obs://bucket/export",
vertex_set_name="set_vertex",class EnvConfig:
"""环境配置管理 - 支持环境变量和配置文件读取"""
ENV_DIR = os.path.join(SKILL_DIR, '.env')
ENV_VAR_MAPPING = {
'GES_GRAPH_IP': 'graph_ip',}
}
resp = requests.post(url, headers=headers, json=data, timeout=30, verify=False)
if resp.status_code not in [200, 201]:
raise Exception(f"密码获取Token失败: {resp.status_code}, {resp.text[:200]}")'X-Identity-Sign': authorization_header
}
resp = requests.post(url, data=Body, headers=headers, timeout=30, verify=False)
if resp.status_code not in [200, 201]:
raise Exception(f"AKSK获取Token失败: {resp.status_code}, {resp.text[:200]}")url=url,
headers=request_headers,
data=body,
verify=False
)
if response.status_code >= 400:url = f"{self.base_url}{path}"
headers = self._get_headers()
resp = requests.request(method, url, headers=headers, **kwargs, verify=False)
if resp.status_code >= 400:
raise Exception(f"API请求失败 [{resp.status_code}]: {resp.text}")Detected: suspicious.insecure_tls_verification