huawei-cloud-gaussdb-instance-management

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:34 AM UTC
• Version: 1.0.0

Overview

This Huawei GaussDB management skill is coherent, but it needs review because its setup and helper script can exercise broad cloud authority and handle database secrets without tight safeguards.

Install only after reviewing the helper script and using least-privilege, preferably temporary Huawei Cloud credentials. Avoid the unverified latest installer pattern, do not grant GaussDB FullAccess as a convenience fallback, use non-production resources for verification, and protect or delete any JSON request files that contain database administrator passwords.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-installation-guide.md:8
• Finding: Unverified Mutable Remote Installer Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation-guide.md:8-10` **Vulnerability Type**: Remote execution of an unpinned network payload **Risk Level**: High ### Vulnerable Code ```bash # One-line install (Linux/macOS) curl -sSL https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh -o hcloud_install.sh bash hcloud_install.sh ``` ### Technical Analysis The installation procedure downloads a shell script from a mutable `latest` URL and executes it without verifying a cryptographic signature, checksum, immutable version, or expected file contents. Although the URL appears to be an official Huawei Cloud endpoint and HTTPS protects transport in normal conditions, it does not protect users if the hosted object, storage account, DNS path, certificate authority, or upstream release process is compromised. The payload executed by users can also change after the Skill has been audited. This behavior is directly related to installing the declared CLI dependency, but the integrity controls are insufficient for safely executing remotely retrieved code. ### Attack Path 1. An attacker compromises the remote object, release pipeline, hosting account, or another component controlling the `latest` installer. 2. The attacker replaces the installer with a modified shell script. 3. A user follows the Skill's installation guide and downloads the current payload. 4. The user executes `bash hcloud_install.sh` without checking its identity or integrity. 5. The modified script runs arbitrary commands with the privileges of that user. ### Impact Assessment Successful exploitation permits arbitrary local command execution under the account running the installer. Depending on that account's privileges and local configuration, an attacker could: - Read Huawei Cloud credentials or KooCLI profiles accessible to the user. - Modify local files or developer tooling. - Steal database request files and infrastructure metadata. - ...[truncated 351 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin KooCLI to a specific reviewed version instead of using a mutable `latest` URL. 2. Publish and verify a SHA-256 or stronger checksum obtained through an independently authenticated channel. 3. Prefer a vendor-signed package and verify its signature against a pinned vendor key. 4. Fail closed if verification fails; never continue to execution. 5. Document the expected installer version and checksum in the Skill. 6. Review the downloaded script before execution and avoid elevated privileges unless explicitly required. For example: ```bash HCLOUD_VERSION="7.2.12" EXPECTED_SHA256="<vendor-published-sha256>" curl --fail --show-error --location \ "https://trusted.example/hcloud/${HCLOUD_VERSION}/hcloud_install.sh" \ --output hcloud_install.sh printf '%s %s\n' "${EXPECTED_SHA256}" hcloud_install.sh | sha256sum --check - bash hcloud_install.sh ``` ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:192
• Finding: Database Administrator Passwords Are Placed in Persistent Plaintext JSON Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:192-232` and `SKILL.md:244-267` **Vulnerability Type**: Plaintext sensitive-data storage and unsafe request-file handling **Risk Level**: High ### Vulnerable Code The Skill instructs users to place the complete create-instance request, including the database password, in a JSON file: ```markdown **`--cli-jsonInput` body files for the create commands.** `--mode`, `--password` and `--region` are also KooCLI system-parameter names, so passing them directly on the command line triggers the interactive ambiguity prompt above (EOF in non-interactive mode). The whole request body therefore goes into a JSON file referenced by `--cli-jsonInput` ``` MySQL-compatible example: ```json { "header": { "X-Language": "en-us" }, "path": { "project_id": "" }, "body": { "name": "gaussdb-mysql-demo", "availability_zone_mode": "multi", "master_availability_zone": "cn-north-4a", "mode": "Cluster", "slave_count": 2, "datastore": { "type": "gaussdb-mysql", "version": "8.0" }, "flavor_ref": "gaussdb.mysql.xlarge.x86.4", "vpc_id": "vpc-xxxxxxxx", "subnet_id": "subnet-xxxxxxxx", "region": "cn-north-4", "password": "ExamplePwd@123", "charge_info": { "charge_mode": "postPaid" }, "backup_strategy": { "start_time": "03:00-04:00" } } } ``` The openGauss example likewise contains: ```json "password": "ExamplePwd@123", "region": "cn-north-4" ``` ### Technical Analysis Using `--cli-jsonInput` may be necessary to avoid KooCLI parameter-name ambiguity, but the Skill provides no controls for protecting the resulting plaintext file. It does not require restrictive file permissions, a secure temporary directory, source-control exclusion, or deletion after use. Consequently, a production database administrator password can remain in: - A world- or group-readable file, depending on the user's `umask`. - Source-control histor ...[truncated 1590 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a unique, randomly generated password rather than a reusable example. 2. Create request files only in a private temporary directory: ```bash umask 077 request_file="$(mktemp)" chmod 600 "${request_file}" ``` 3. Register cleanup before writing the secret: ```bash trap 'rm -f -- "${request_file}"' EXIT HUP INT TERM ``` 4. Ensure the file is removed immediately after the KooCLI invocation. 5. Add `input.json`, `input_opengauss.json`, and comparable secret-bearing request files to `.gitignore`. 6. Warn users that ordinary deletion may not remove copies from snapshots, editor recovery files, or source-control history. 7. Prefer a secure secret-management integration or protected process substitution if KooCLI supports it. 8. Clearly mark all example passwords as invalid placeholders that must never be used in production. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gaussdb_cli.sh:27
• Finding: Mutating Operations Can Bypass Confirmation Through a Fixed Denylist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gaussdb_cli.sh:27-47` **Vulnerability Type**: Incomplete authorization and confirmation enforcement **Risk Level**: High ### Vulnerable Code ```bash # Mutating operations (R2 preview+confirm, R1 risk-confirm) per SKILL.md MUTATING_OPS=" CreateGaussMySqlInstance CreateInstance CreateGaussMySqlBackup CreateManualBackup CreateGaussMySqlReadonlyNode CreateReadonlyNodes RunInstanceAction AddDatabasePermission DeleteDatabasePermission AllowDbPrivileges DeleteGaussMySqlInstance DeleteInstance " if echo "${MUTATING_OPS}" | grep -qw "${OPERATION}"; then echo "Mutating operation: ${SERVICE} ${OPERATION}" >&2 read -r -p "Confirm execution? (yes/no): " _answer if [[ "${_answer}" != "yes" ]]; then echo "Cancelled." >&2 exit 0 fi fi ``` The wrapper later executes arbitrary caller-provided service and operation values: ```bash OUTPUT="$(hcloud "${SERVICE}" "${OPERATION}" "$@" 2>&1)" || true ``` ### Technical Analysis The wrapper advertises confirmation for mutating operations but implements this boundary as a fixed denylist. Both `SERVICE` and `OPERATION` come from caller-controlled positional arguments, and neither is validated against the twelve declared Skill actions. Any valid KooCLI mutation that is absent from `MUTATING_OPS`, including an operation introduced by a future KooCLI metadata update, skips confirmation. This is a fail-open safety design: unknown operations are implicitly treated as read-only. Argument quoting prevents conventional shell metacharacter injection here, but it does not prevent logical bypass of the confirmation policy. ### Attack Path 1. An attacker, compromised agent, or mistaken caller selects a valid mutating KooCLI operation not listed in `MUTATING_OPS`. 2. The caller invokes: ```bash scripts/gaussdb_cli.sh <service> <unlisted-mutating-operation> [parameters] ``` 3. The denylist comparison does not match the operation. 4. The wrapper d ...[truncated 729 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the mutation denylist with a fail-closed allowlist: 1. Allowlist the exact supported service-and-operation pairs. 2. Separately allowlist the known read-only pairs. 3. Require confirmation for every supported operation not explicitly classified as read-only. 4. Reject all unknown services and operations instead of passing them through. 5. Bind operation names to the expected service so similarly named operations cannot be rerouted. 6. For R1 operations, require a stronger confirmation containing the target resource identifier. 7. Display the complete argument array and intended target before confirmation. Example policy structure: ```bash case "${SERVICE}:${OPERATION}" in GaussDB:ListGaussMySqlInstances|\ GaussDB:ShowGaussMySqlInstanceInfo|\ gaussdbforopengauss:ListInstances) # Explicitly approved read-only operations. ;; GaussDB:CreateGaussMySqlInstance|\ GaussDB:DeleteGaussMySqlInstance|\ gaussdbforopengauss:CreateInstance|\ gaussdbforopengauss:DeleteInstance) # Require confirmation. ;; *) echo "ERROR: Unsupported service or operation" >&2 exit 2 ;; esac ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gaussdb_cli.sh:66
• Finding: KooCLI Process Failures Are Converted to Successful Exit Status<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gaussdb_cli.sh:66-75` **Vulnerability Type**: Improper error handling and fail-open status reporting **Risk Level**: Medium ### Vulnerable Code ```bash OUTPUT="$(hcloud "${SERVICE}" "${OPERATION}" "$@" 2>&1)" || true STATUS=$? # hcloud exits 0 even on API/CLI errors — detect them by output content if grep -qiE "error|failed|exception|not found|invalid|缺少必填参数" <<<"${OUTPUT}"; then echo "hcloud reported an error:" >&2 echo "${OUTPUT}" >&2 exit 1 fi echo "${OUTPUT}" exit "${STATUS}" ``` ### Technical Analysis The `|| true` expression causes the assignment command to return success even when `hcloud` exits with a nonzero status. `STATUS=$?` therefore records the exit status of the complete successful expression, which is zero rather than the original KooCLI status. The fallback text scan is not a reliable replacement for process status. It only detects a limited set of English and Chinese substrings and can miss: - Errors expressed with different wording. - Local execution failures without one of the selected terms. - Structured error responses that do not match the regular expression. - Future or localized KooCLI messages. It may also produce false positives if successful output contains words such as `error` in descriptive data. ### Attack Path 1. KooCLI encounters a local, transport, authentication, or API failure and exits nonzero. 2. The resulting output does not contain a string matched by the regular expression. 3. `|| true` replaces the failed command status with zero. 4. The wrapper prints the output and exits successfully. 5. An agent or automation pipeline treats the requested operation as completed and proceeds on an invalid assumption. ### Impact Assessment This issue does not directly grant additional permissions, but it undermines the integrity of cloud-management workflows. Potential consequences include: - Reporting failed backups as successful. - Assuming permission ...[truncated 350 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Preserve the original process exit status without relying on `|| true`. 2. Treat any nonzero status as failure, regardless of output wording. 3. If KooCLI sometimes returns zero for API errors, additionally parse its documented structured response or known error schema. 4. Keep text matching only as a secondary compatibility check. 5. Send successful output to standard output and failures to standard error. 6. Add tests covering nonzero exits, localized errors, structured API errors, and successful output containing error-like words. A safer pattern is: ```bash set +e OUTPUT="$(hcloud "${SERVICE}" "${OPERATION}" "$@" 2>&1)" STATUS=$? set -e if (( STATUS != 0 )); then echo "${OUTPUT}" >&2 exit "${STATUS}" fi if grep -qiE "error|failed|exception|not found|invalid|缺少必填参数" <<<"${OUTPUT}"; then echo "hcloud reported an error:" >&2 echo "${OUTPUT}" >&2 exit 1 fi printf '%s\n' "${OUTPUT}" ``` ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/iam-policies.md:90
• Finding: Full-Access IAM Fallback Exceeds the Skill's Minimum Required Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/iam-policies.md:90-95` **Vulnerability Type**: Excessive cloud authorization guidance **Risk Level**: High ### Vulnerable Code ```markdown > **Note:** Cloud service action names above follow Huawei Cloud IAM's `service:action` > granularity. If a specific action key is not accepted by your IAM console, grant the > coarse-grained `GaussDB FullAccess` (read+manage) or `GaussDB ReadOnlyAccess` > (read-only) **and** `VPC ReadOnlyAccess`, then tighten later. Never embed AK/SK in > policies or scripts. ``` ### Technical Analysis The Skill declares twelve bounded actions and presents tier-specific policies, but then recommends `GaussDB FullAccess` when a specific action key is rejected. Full access is broader than necessary for query-only sessions, individual management operations, and the Skill's defined operation set. The instruction to “tighten later” creates an open-ended period of excessive privilege and offers no enforcement mechanism to ensure that the permission is subsequently removed. This contradicts the stated least-privilege objective. ### Attack Path 1. An operator attempts to apply one of the documented granular policies. 2. The IAM console rejects an incorrect or unsupported action identifier. 3. Following the fallback guidance, the operator grants `GaussDB FullAccess`. 4. The active KooCLI credential now has permissions beyond the Skill's required action. 5. A compromised agent session, malicious local process, or accidental command uses those permissions to perform unrelated GaussDB administration. ### Impact Assessment The exact authorization scope is determined by Huawei Cloud's managed `GaussDB FullAccess` policy. Relative to the Skill's declared functionality, the principal may obtain the ability to perform additional administrative operations across in-scope projects or resources. Possible effects include: - Unintended instance lifecycle changes. - Configuration changes ...[truncated 435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `GaussDB FullAccess` as a normal fallback. 2. Verify all documented IAM action identifiers against current Huawei Cloud documentation before publication. 3. Provide separate, tested policies for: - Query and analysis. - Instance creation. - Backup creation. - Node expansion. - Database permission changes. - Instance deletion. 4. Scope resources to explicit project and instance identifiers wherever Huawei IAM supports resource-level restrictions. 5. If a broad managed policy is temporarily unavoidable, require: - Time-bounded assignment. - Separate approval. - Audit logging. - Immediate revocation after the specific operation. 6. Use separate credentials or roles for R3, R2, and R1 operations. 7. Fail closed when the requested granular policy cannot be validated rather than silently broadening access. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:327
• Finding: Future Quality Telemetry Uses an Unpinned SDK and May Transmit Operational Data< (vendored from the skillsopr repo) so each run reports trace_id, status (success/biz_fail/sys_fail/cancel), error code, cost, and masked input/output to the operations console. ``` ```python from skill_quality_sdk import quality_context, QualityError with quality_context(skill_name="huawei-cloud-gaussdb-instance-management", skill_version="1.0.0") as q: q.input = {"action": "huawei_list_gaussdb_instances", "region": "cn-north-4"} result = do_something() q.output = result ``` ```markdown The quality SDK is fetched from the skillsopr repo and placed in `scripts/` only when a Python wrapper is added. ``` ```markdown Reporting is non-blocking and fails silently — it never interrupts the Skill main flow. Disable via `SKILL_QUALITY_DISABLE=1` for local testing. ``` The configured destination is documented at `SKILL.md:79`: ```markdown | `SKILL_QUALITY_ENDPOINT` | No | Quality report endpoint, default https://skillsapi.developer.myhuaweicloud.com/api/quality/report | ``` ### Technical Analysis No Python quality SDK is included in the audited project, and the current shell wrapper does not implement this reporting. Therefore, the reviewed code does not presently prove active telemetry transmission. However, the Skill mandates a future integration that: - Fetches code from an unpinned repository branch. - Reports masked action input and output. - Enables reporting by default unless explicitly disabled. - Permits the destination to be changed through `SKILL_QUALITY_ENDPOIN ...[truncated 2004 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not fetch the SDK from a mutable branch during installation or execution. 2. Pin the dependency to an immutable commit or signed release and verify its checksum. 3. Review and vendor the exact audited SDK version. 4. Make telemetry explicitly opt-in rather than enabled by default. 5. Use a fixed allowlist of approved reporting destinations; reject arbitrary endpoint overrides in production. 6. Define a strict telemetry schema containing only necessary fields. 7. Never report raw CLI input or output. 8. Explicitly exclude passwords, AK/SK values, authorization headers, request files, database names, host addresses, and resource identifiers unless demonstrably required. 9. Apply and test redaction before data reaches the SDK. 10. Document retention, transport security, access controls, and user consent. 11. Log a local, non-sensitive indication when reporting occurs instead of failing completely silently. 12. Add automated tests proving that representative GaussDB responses and create-instance request bodies cannot leak secrets. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation list includes generic terms such as "openGauss", "sharding", and "分片", which can arise in ordinary technical discussion without an intent to invoke this specific skill. Although many triggers are specific, these broad standalone terms increase the risk of unintended invocation because the file does not provide exclusion conditions or negative examples.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Identify the product family** from the user's request: MySQL-compatible (`GaussDB`
   service) vs openGauss distributed (`gaussdbforopengauss` service). If unsure, run
   `huawei_list_gaussdb_instances` and inspect `datastore.type` / product fields.
2. **Query tier (R3)** — execute read-only actions directly, no confirmation needed.
3. **Analyze tier (R3)** — run the composite read-only commands, summarize findings
   (deployment form: shards / readonly nodes / engine version; security: security group
   port exposure + SSL state).

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Data Flow Diagram

## Query / Analyze (R3 — read-only, auto-execute)

```mermaid
sequenceDiagram

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The user utterance examples are written only in Chinese ("列出 GaussDB 实例", "分析部署形态", "创建 GaussDB 实例", "删除实例") and the diagram does not indicate that other languages are supported or that Chinese is required for a justified regional purpose. This can violate language/locale policy because it implicitly constrains usage to a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The verification guide instructs operators to run destructive and cost-incurring management actions such as creating instances, adding capacity, and deleting instances, but it does not present a clear warning section describing deletion risk, billing consequences, or the need to use test resources only. In a cloud infrastructure skill, omission of explicit safety guardrails materially increases the chance of accidental spend, service disruption, or irreversible data loss during 'verification' workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Action | Success criteria |
|--------|------------------|
| `huawei_create_gaussdb_instance` | Job/order response with `id`/`job_id`; follow up via `ListGaussMySqlInstances` until `status=ACTIVE` (may take 10-30 min). |
| `huawei_create_gaussdb_backup` | `job_id`/`backup_id` returned; verify via `ShowGaussMySqlBackupList`. |
| `huawei_add_gaussdb_readonly_node` | `job_id` returned; verify via `ListInstanceNode` — node count increased. |
| `huawei_add_gaussdb_sharding_node` | `job_id` returned; verify via `ShowShardDiskMessages` — shard count increased. |
| `huawei_update_gaussdb_database_permission` | Success message; verify via `ListGaussMySqlDatabaseUser` and instance's user list. |

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The file instructs use of `--X-Language=en-us` and also sets `"X-Language": "en-us"` in request bodies, which imposes a specific language/locale. Under the policy, forcing a locale without user opt-in is a natural-language policy concern unless the restriction is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The example JSON sets `"X-Language": "en-us"`, which directs the skill toward a fixed locale. The document does not state that this locale is mandatory for compliance or functionality, nor does it offer the user a choice.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The openGauss create-instance example also fixes `"X-Language": "en-us"` in the header. Because no alternate locale handling or opt-in is described, this appears to force a specific language setting.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The file specifies a concrete language header of `en-us` as the required sample value, which imposes a specific locale in the instructions. Because the document does not present this as an optional example, user choice, or region-specific policy requirement, it may violate the language/locale policy.

Static analysis

No suspicious patterns detected.