Security audit
Security checks across malware telemetry and agentic risk
This Huawei Cloud testing skill has a legitimate testing purpose, but it can run generated shell/Python commands and cloud write operations with credentials without the user confirmation its docs promise.
Install only after review, and run only in an isolated test account with least-privilege temporary Huawei Cloud credentials. Do not use production AK/SK or valuable billing resources. Treat tested skills as code that may be executed by this framework, and inspect generated phase files before phase 4 or phase 6.
snippet_lines.append('from huaweicloudsdk%s.%s import %s, %s' % (svc, sdk_ver, client_cls, request_class))
snippet_lines.append('')
snippet_lines.append('ak, sk = "", ""')
snippet_lines.append('for k, v in os.environ.items():')
snippet_lines.append(' u = k.upper()')
snippet_lines.append(" if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue")
snippet_lines.append(" if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or ak")client_class = getattr(mod, client_cls_name)
from huaweicloudsdkcore.auth.credentials import BasicCredentials, GlobalCredentials
ak, sk = '', ''
for k, v in os.environ.items():
u = k.upper()
if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')): continue
if 'ACCESS_KEY' in u or u.endswith('_AK') or u == 'AK': ak = v or akIterate over each test case:
if is_write == false:
Auto-execute → Record pass/fail
if is_write == true:
Show command and expected → Wait for user y/N confirmation
if confirmed:- Extend with additional verification steps
6b: Lifecycle execution
- Execute each step against real Huawei Cloud environment
- Read-only steps auto-execute; write steps prompt user
6c: State consistency verification
- After each write operation, verify via read operation
- Confirm resource state matches expected# Remove leading/trailing pipes and whitespace that might leak from table extraction
cmd_text = cmd_text.strip().lstrip('|').strip()
if cmd_text and len(cmd_text) > 5:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environmethod_name = tc.get('method_name', '')
# If command starts with python3 -c, run as bash (it's a one-liner, not a snippet)
if cmd_text.startswith('python3 -c ') or cmd_text.startswith('python3 -c '):
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=int(os.environ.get('TIMEOUT_CLI', '30')),
env=os.environtry:
sdk_tmp.write(cmd_text)
sdk_tmp.close()
r = subprocess.run(
['python3', sdk_tmp.name],
capture_output=True, text=True, timeout=60,
env=os.environscript_args = ' '.join(script_part.split()[1:]) if len(script_part.split()) > 1 else ''
if os.path.isfile(script_path):
full_cmd = f'python3 {script_path} {script_args}'.strip()
r = subprocess.run(['bash', '-c', full_cmd], capture_output=True, text=True, timeout=60, env=os.environ)
output = (r.stdout[:1000] + '\n' + r.stderr[:500]).strip()
status = 'pass' if r.returncode == 0 else 'fail'
else:if not os.path.isfile(script_path):
script_path = os.path.join(skill_root, 'scripts', os.path.basename(script_part))
if os.path.isfile(script_path):
r = subprocess.run(['bash', script_path, skill_root], capture_output=True, text=True, timeout=60)
output = (r.stdout[:1000] + '\n' + r.stderr[:500]).strip()
status = 'pass' if r.returncode == 0 else 'fail'
else:# Unknown executor: try running command text as shell command
cmd_text = tc.get('command', '')
if cmd_text.strip() and len(cmd_text) > 10:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=30,
env={**__import__('os').environ}try:
sdk_tmp.write(cmd_text)
sdk_tmp.close()
r = subprocess.run(
['python3', sdk_tmp.name],
capture_output=True, text=True, timeout=60,
env=os.environexcept OSError:
pass
elif executor == 'cli' and cmd_text:
r = subprocess.run(
['bash', '-c', cmd_text],
capture_output=True, text=True, timeout=30,
env=os.environscript_args = ' '.join(script_part.split()[1:]) if len(script_part.split()) > 1 else ''
if os.path.isfile(script_path):
full_cmd = f'python3 {script_path} {script_args}'.strip()
r = subprocess.run(['bash', '-c', full_cmd], capture_output=True, text=True, timeout=60, env=os.environ)
step['output'] = (r.stdout[:500] + r.stderr[:200]).strip()
step['status'] = 'pass' if r.returncode == 0 else 'fail'
else:local skill_dir="$1"
[ -z "$skill_dir" ] && { fail "cleanup_phase_files: skill_dir 为空"; return 1; }
info "🧹 --fresh: 清理 ${skill_dir}/phase-*.json"
rm -f "${skill_dir}"/phase-*.json
info "✅ 已清理"
}local phase_files; phase_files=$(ls "$sp"/phase-*.json 2>/dev/null)
if [ -n "$phase_files" ]; then
step "删除 ${sn} 中的阶段文件..."
rm -f "$sp"/phase-*.json
pass " phase-*.json 已删除"
fi
doneVirusTotal findings are pending for this skill version.
No suspicious patterns detected.