Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for CloudRobo workflows, but it can create cloud resources and execute real-robot tasks without a strong final safety and cost confirmation gate.
Install only if you intend to let an agent operate CloudRobo with your Huawei Cloud credentials. Before using it, require explicit confirmation for each cloud write, expected cost, selected workspace, selected robot, task text, execution limits, and emergency-stop readiness; treat exported robot certificates as secrets.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Set required environment variables
# ⚠️ NEVER commit real keys. Use a secrets manager or .env file.
export HUAWEI_CLOUD_AK="your-access-key-id"
export HUAWEI_CLOUD_SK="your-secret-access-key"
The trigger list contains very broad phrases such as '训练部署', '部署评测', 'model workflow', and 'train and deploy', which can match generic requests and invoke a skill that performs cloud resource creation, model deployment, and real-robot evaluation. In this context, over-broad activation is dangerous because the skill orchestrates consequential actions across multiple stages, increasing the chance of unintended execution on expensive infrastructure or physical robots.
The skill description and workflow do not present an upfront explicit warning that using the skill may create billable cloud training/deployment resources and can execute tasks on real robots. Because this skill spans model training, inference deployment, and real-robot dispatch, the lack of a prominent warning materially raises the risk that a user triggers costly or safety-relevant operations without informed consent.
This workflow explicitly includes creating and executing real-robot dispatch tasks, but the diagram contains no operator confirmation gate, safety preconditions, or user-facing warning before physical actuation. In a robotics orchestration skill, omission of these controls can normalize unattended execution and increase the chance of unsafe motion, collisions, or damage when users invoke deploy/eval flows end-to-end.
The document describes exporting robot certificates during onboarding without any handling guidance, secrecy requirements, or lifecycle controls for the certificate material. Certificate export steps can expose authentication credentials that may allow unauthorized robot onboarding, impersonation, or control if logged, copied, or stored insecurely.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Task `FAILED` | Model inference error or robot execution exception | Check `show-task-result` logs |
| Task `CANCELLED` | Manually cancelled | Recreate task |
> After fixing, create a new task to retry (`create-task` auto-executes).
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Only run the pipeline stages the user actually needs — a query-only workflow touches
only read endpoints
- Write operations (asset create/import, train create-task, infer create/start, dispatch
create-task/cancel-task) require explicit user confirmation before execution
- AK/SK must come from environment variables or `~/.cloudrobo/config.yaml` — never hardcode
- Keep all pipeline resources within a single workspace to keep the blast radius contained
The template instructs operators to create and execute a real-robot task immediately via dispatch create-task, but does not require an explicit user confirmation or safety warning that this action will cause physical robot movement. In a model-training/deployment workflow for real robots, silent transition from planning to execution materially increases the risk of unintended physical actions, equipment damage, or human safety incidents.
The instruction includes Chinese text inline within otherwise English guidance, including '具身广场' and '不该带的参数不要带', without indicating that the user can choose language or locale. This can violate a language/locale policy when a skill effectively forces or assumes a specific language presentation without opt-in.
No suspicious patterns detected.