Security audit
Security checks across malware telemetry and agentic risk
Review recommended: this is a real Huawei Cloud test runner, but it can run extracted commands with cloud credentials and its write-confirmation/audit behavior is weaker than advertised.
Install only if you intend to run live Huawei Cloud tests. Use an isolated test account/project, least-privilege short-lived credentials, keep ALLOW_WRITES and ALLOW_REAL_E2E unset unless you have reviewed the exact generated cases, prefer --no-siblings unless cross-skill testing is intended, and periodically inspect or delete retained <skill-name>-test-files artifacts.
snippet_lines.append('from huaweicloudsdk%s.%s import %s, %s' % (svc, sdk_ver, client_cls, request_class))
snippet_lines.append('')
snippet_lines.append('ak, sk = "", ""')
snippet_lines.append('for k, v in os.environ.items():')
snippet_lines.append(' u = k.upper()')
snippet_lines.append(" if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue")
snippet_lines.append(" if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak")client_class = getattr(mod, client_cls_name)
from huaweicloudsdkcore.auth.credentials import BasicCredentials, GlobalCredentials
ak, sk = '', ''
for k, v in os.environ.items():
u = k.upper()
if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue
if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or akPer-case gate:
if is_write == false:
Auto-execute → Record pass/fail
if is_write == true:
if env ALLOW_WRITES == "1":
Auto-execute under AK/SK credentials → Record pass/fail + resource_changesAuto-execute → Record pass/fail
if is_write == true:
if env ALLOW_WRITES == "1":
Auto-execute under AK/SK credentials → Record pass/fail + resource_changes
entry.execution_meta.user_confirmed = true
else (default):
Skip → status=skip, reason="ALLOW_WRITES=0"- Sort all feature points by list → create → update → delete
- Chain into a single-skill resource lifecycle
- Execute each step via real SDK/CLI against the live environment
- Read-only steps auto-execute; write steps gated by ALLOW_WRITES=0|1
(default 0, skipped with status=skip in the report)
- Verify resource state after each mutation
- AK/SK credentials required (3-tier resolution, see § Phase 4)for svc_pkg, sdk_cls in _sdk_map.items():
try:
import_cmd = f'from huaweicloudsdk{svc_pkg}.v2 import {sdk_cls}'
r = subprocess.run(
['python3', '-c', import_cmd],
capture_output=True, text=True, timeout=10
)# Remove leading/trailing pipes and whitespace that might leak from table extraction
cmd_text = cmd_text.strip().lstrip('|').strip()
if cmd_text and len(cmd_text) > 5:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environmethod_name = tc.get('method_name', '')
# If command starts with python3 -c, run as bash (it's a one-liner, not a snippet)
if cmd_text.startswith('python3 -c ') or cmd_text.startswith('python3 -c '):
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environVirusTotal findings are pending for this skill version.
No suspicious patterns detected.