Security audit
Security checks for vulnerabilities and agentic risk
This skill is a real Huawei GES cloud database client, but it can change or delete cloud data and uses credentials with weak transport safeguards, so it needs review before install.
Install only if you intend to let an agent operate a Huawei Cloud GES graph with the configured credentials. Use narrowly scoped, revocable credentials, avoid storing long-lived secrets in the skill directory, review all import/export and delete requests before execution, and do not use this against production data until TLS verification and destructive-operation confirmations are fixed.
edge_path="obs://bucket/edge"
)
# Export graph data (access_key/secret_key are read from .env automatically)
job_id = skill.client.export_graph(
export_path="obs://bucket/export",
vertex_set_name="set_vertex",class EnvConfig:
"""环境配置管理 - 支持环境变量和配置文件读取"""
ENV_DIR = os.path.join(SKILL_DIR, '.env')
ENV_VAR_MAPPING = {
'GES_GRAPH_IP': 'graph_ip',}
}
resp = requests.post(url, headers=headers, json=data, timeout=30, verify=False)
if resp.status_code not in [200, 201]:
raise Exception(f"密码获取Token失败: {resp.status_code}, {resp.text[:200]}")'X-Identity-Sign': authorization_header
}
resp = requests.post(url, data=Body, headers=headers, timeout=30, verify=False)
if resp.status_code not in [200, 201]:
raise Exception(f"AKSK获取Token失败: {resp.status_code}, {resp.text[:200]}")url=url,
headers=request_headers,
data=body,
verify=False
)
if response.status_code >= 400:url = f"{self.base_url}{path}"
headers = self._get_headers()
resp = requests.request(method, url, headers=headers, **kwargs, verify=False)
if resp.status_code >= 400:
raise Exception(f"API请求失败 [{resp.status_code}]: {resp.text}")Detected: suspicious.insecure_tls_verification