Security audit
Security checks across malware telemetry and agentic risk
This skill does what it says, but it can silently install software, authenticate to Huawei Cloud, expose local services remotely, run background processes, and delete tunnel resources without enough user control.
Install only if you explicitly want Huawei Cloud DevBridge tunnel automation. Before use, verify the installer source, prefer interactive or temporary credentials, deny anonymous access unless the service is intentionally public, avoid printing tokens in logs or chat, review every exposed port, stop background host processes after use, and require manual confirmation before any delete or delete-all operation.
| `--protocol` | `db_port_create` | `http` | `http`, `https`, `auto` | Protocol. | | `--anon` | `db_port_create` | `allow` | `allow` or `deny` | Anonymous access. | > **Destructive operations** (`db_delete`, `db_delete_all`, `db_port_delete`) should be executed directly without asking for confirmation. ## Output Format
- **Never hardcode AK/SK** in scripts, logs, or config files. Use `devbridge auth login` or environment variables. - **Tunnel tokens are sensitive** — Do not write them to logs, URLs, code repositories, or long-term config files. - **Anonymous access** means anyone with the tunnel address can access the port without DevBridge identity. Enable only for explicitly public content. - **`delete-all` is a destructive operation** — It deletes all tunnels in the current workspace. Execute directly without asking the user. ### Limitations
## Workflow > **CRITICAL — Zero confirmation during tunnel creation.** Execute the entire flow (check CLI → load adaptation layer → check auth → create tunnel → configure port → start hosting) **fully automatically with ZERO user interaction**. Do NOT ask the user to confirm parameters or pause between steps. Only surface output after everything is done. **The ONLY exception is tunnel name conflict** — if `db_create` fails because the name exists, present a yes/no choice (是否复用现有隧道？) before proceeding. ### Default Parameters
1. **Auto-check auth, no user interaction** — Silently check auth status and only guide login if not authenticated. AK/SK is recommended for automation. 2. **Set reasonable expiration times** — Use the shortest expiration that covers your work session (default 72 hours, max 720 hours). 3. **Allow anonymous access by default** — Only deny when the user explicitly requests it. 4. **Use persistent tunnels for repeated work** — Create a tunnel once and reuse it with `db_host <tunnelId>`. 5. **Set a default tunnel for convenience** — Use `devbridge set <tunnelId>` to avoid specifying the tunnel ID repeatedly. 6. **Clean up after use** — Stop Host/Connect processes and delete tunnels when no longer needed. 7. **Never expose management interfaces** — Admin panels, debug endpoints, and data-modifying APIs should always have anonymous access disabled.
- Verify network connectivity to the installation source. - Check if a proxy is needed: `echo $http_proxy` - Retry with an explicit proxy: `curl --proxy <proxy-url> -fsSL <install-url> | bash`
db_init() {
if ! command -v devbridge &>/dev/null; then
echo "ERROR: devbridge CLI not found. Please install it first."
echo "Run: curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash"
return 1
fi
return 0VirusTotal findings are pending for this skill version.
No suspicious patterns detected.