Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it can automatically select a script to run with full server privileges, and its smoke test requires access keys in command-line arguments.
Before installing, require explicit script selection and content review, restrict credentials to intended instances and operations, and use a less privileged execution account where possible. Change the smoke test to accept credentials safely and disclose its cloud mutation. Correct the installation instructions and remove test scripts afterward. All eight bundled files were inspected statically; resolved dependency versions and live IAM restrictions remain unverified.
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
pip install -r {baseDir}/requirements.txt -i https://pypi.org/project/huaweicloudsdkcoc/
Dependency resolution is redirected away from a canonical default, adds another source, or uses a destination that cannot be resolved statically.
pip install -r {baseDir}/requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple/
Referenced artifact was not completely inspected
- [Verification Method](references/verification-method.md)
Without declared permissions the skill's intent is opaque and cannot be validated.
The routing list includes broad phrases such as "custom script", "script execution", and "cloud operations", which also describe unrelated scripting and cloud tasks. Although the overview identifies Huawei Cloud as the intended platform, the activation instructions do not require that context or provide exclusions, allowing unintended routing to this skill.
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.