Security audit
Security checks for vulnerabilities and agentic risk
This read-only Huawei Cloud RDS skill is mostly purpose-aligned, but it handles cloud credentials too broadly and disables TLS certificate verification for authenticated API calls.
Review before installing. Use only a dedicated least-privilege Huawei Cloud IAM user, avoid running it in environments containing unrelated Huawei/HW/HWC secrets, and do not use it until TLS certificate verification is enabled. Treat returned instance IDs, network details, and monitoring data as sensitive infrastructure information.
def _load_credentials() -> Tuple[str, str]:
"""动态扫描环境变量获取 AK/SK，不依赖固定变量名。"""
ak, sk = '', ''
for k, v in os.environ.items():
u = k.upper()
if not (u.startswith('HUAWEI') or u.startswith('HW') or u.startswith('HWC')):
continuehuaweicloudsdkrds>=3.1.212 huaweicloudsdkces>=3.1.212 huaweicloudsdkiam>=3.1.212 huaweicloudsdkcore>=3.1.212
huaweicloudsdkrds>=3.1.212 huaweicloudsdkces>=3.1.212 huaweicloudsdkiam>=3.1.212 huaweicloudsdkcore>=3.1.212
huaweicloudsdkrds>=3.1.212 huaweicloudsdkces>=3.1.212 huaweicloudsdkiam>=3.1.212 huaweicloudsdkcore>=3.1.212
huaweicloudsdkrds>=3.1.212 huaweicloudsdkces>=3.1.212 huaweicloudsdkiam>=3.1.212 huaweicloudsdkcore>=3.1.212
No suspicious patterns detected.