Security audit
Security checks across malware telemetry and agentic risk
This cloud testing skill has a coherent purpose, but it can run generated commands and cloud write operations with Huawei credentials without the user confirmations it promises.
Review carefully before installing. Use only disposable, least-privilege Huawei Cloud test credentials in an isolated environment, avoid production accounts, inspect generated phase-3 test cases before Phase 4, and do not run --all-installed or --fresh unless you are comfortable with local skill installs, phase files, reports, and cloud resources being changed or removed.
snippet_lines.append('from huaweicloudsdk%s.%s import %s, %s' % (svc, sdk_ver, client_cls, request_class))
snippet_lines.append('')
snippet_lines.append('ak, sk = "", ""')
snippet_lines.append('for k, v in os.environ.items():')
snippet_lines.append(' u = k.upper()')
snippet_lines.append(" if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue")
snippet_lines.append(" if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak")client_class = getattr(mod, client_cls_name)
from huaweicloudsdkcore.auth.credentials import BasicCredentials, GlobalCredentials
ak, sk = '', ''
for k, v in os.environ.items():
u = k.upper()
if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue
if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak# Remove leading/trailing pipes and whitespace that might leak from table extraction
cmd_text = cmd_text.strip().lstrip('|').strip()
if cmd_text and len(cmd_text) > 5:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environmethod_name = tc.get('method_name', '')
# If command starts with python3 -c, run as bash (it's a one-liner, not a snippet)
if cmd_text.startswith('python3 -c ') or cmd_text.startswith('python3 -c '):
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environtry:
sdk_tmp.write(cmd_text)
sdk_tmp.close()
r = subprocess.run(
['python3', sdk_tmp.name],
capture_output=True, text=True, timeout=60,
env=os.environscript_args = ' '.join(script_part.split()[1:]) if len(script_part.split()) > 1 else ''
if os.path.isfile(script_path):
full_cmd = f'python3 {script_path} {script_args}'.strip()
r = subprocess.run(['bash', '-c', full_cmd], capture_output=True, text=True, timeout=60, env=os.environ)
output = (r.stdout[:1000] + '\n' + r.stderr[:500]).strip()
status = 'pass' if r.returncode == 0 else 'fail'
else:if not os.path.isfile(script_path):
script_path = os.path.join(skill_root, 'scripts', os.path.basename(script_part))
if os.path.isfile(script_path):
r = subprocess.run(['bash', script_path, skill_root], capture_output=True, text=True, timeout=60)
output = (r.stdout[:1000] + '\n' + r.stderr[:500]).strip()
status = 'pass' if r.returncode == 0 else 'fail'
else:# Unknown executor: try running command text as shell command
cmd_text = tc.get('command', '')
if cmd_text.strip() and len(cmd_text) > 10:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=30,
env={**__import__('os').environ}VirusTotal findings are pending for this skill version.
No suspicious patterns detected.