Security audit
Security checks for vulnerabilities and agentic risk
The cloud queries are read-only, but the skill directs the agent to save potentially sensitive results without defining user approval, storage protections, or cleanup.
Before enabling, require approval for saving query results and define a private storage location and deletion period. Use dedicated read-only credentials, preferably temporary ones, and keep TLS verification enabled. Review and lock dependency versions before installation. All bundled files were inspected and the scanner's reference gaps were resolved; third-party dependency behavior and live cloud execution remain unverified.
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill directs the agent to persist large cloud-resource results without specifying a protected location, restrictive permissions, or deletion policy. Inventory and configuration data can reveal sensitive infrastructure details if cached in shared, synchronized, or version-controlled locations; the read-only cloud API assurance does not protect these local copies.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
| # | Criterion | Verification | Status |
|---|-----------|--------------|--------|
| AC-14 | Read-only: no write API called | Grep scripts for create/update/delete API usage — none exist | ☐ |
| AC-15 | No credential leakage in output | Run any script with `--upgrade`-style failures; output contains error codes only, never AK/SK values | ☐ |
| AC-16 | Scripts executed via `skill action=exec` | SKILL.md declares the execution contract; no direct shell python invocation documented | ☐ |
| AC-17 | Exit code semantics | Success/empty → 0; failure → 1; missing args → 2 | ☐ |
The trigger list includes standalone terms such as "Config" and "SQL query", which commonly occur outside Huawei Cloud Config. Although the description identifies the service, it does not explicitly require that context for these triggers or exclude unrelated configuration and database requests.
The lower-bound-only requirement allows installation of unreviewed future huaweicloudsdkcore releases, making builds non-reproducible. If a subsequently selected release is compromised, its code executes in a process with access to cloud credentials; this is a supply-chain exposure, not evidence of an existing compromise.
huaweicloudsdkcore>=3.1.208
huaweicloudsdkconfig>=3.1.208
urllib3>=2.6.3
The open-ended huaweicloudsdkconfig requirement permits future releases that have not been reviewed or tested with this skill. A compromised selected release could execute with access to the skill's cloud credentials and resource results, although no compromised release is demonstrated here.
huaweicloudsdkcore>=3.1.208
huaweicloudsdkconfig>=3.1.208
urllib3>=2.6.3
The urllib3 lower bound does not constrain installation to a reviewed artifact, so otherwise identical installations can obtain different future code. A compromised selected package would execute in the credential-bearing environment; the manifest alone does not demonstrate that any current urllib3 release is compromised.
huaweicloudsdkcore>=3.1.208
huaweicloudsdkconfig>=3.1.208
urllib3>=2.6.3
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
The request hardcodes its language setting to Simplified Chinese, with no caller parameter or user opt-in. The file provides no documented justification for requiring this locale for policy-definition responses.