Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly aligned with deploying and managing FlexusAgent, but it exposes admin/cloud secrets in logs or chat and uses high-privilege remote script execution that needs human review.
Review before installing. Use a dedicated least-privilege, time-limited Huawei Cloud identity; avoid passing AK/SK, tokens, admin passwords, or API keys on command lines; do not share logs from runs; confirm whether public port 80 exposure is acceptable; and inspect or pin the externally fetched shell scripts and dependencies before using this in a production account.
## Parameter Confirmation Before executing any command, the command's parameters must be confirmed. ---
## Parameter Confirmation Before executing any command, the command's parameters must be confirmed. ---
"description": "Change FlexusAgent admin user password",
"risk_level": "LOW",
"content": '''#!/bin/bash
curl -sSL https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/agent/reset_admin_password.sh | bash -s "${adminPassword}"'''
},
"import_dify_app_workflow": {
"name": "import_dify_app_workflow","type": "SHELL",
"description": "import dify app workflow on dify server instance",
"risk_level": "MEDIUM",
"content": '''curl -sSL https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/scripts/import_yml_to_dify.sh | bash -s ${base64String} ${dify_admin_password}'''
},
}VirusTotal findings are pending for this skill version.
No suspicious patterns detected.