Scanned skills

huaweicloud/huaweicloud-skills huawei-cloud-iam-query

Checked the catalogued skill at huawei-cloud-iam-query.

SkillTrust corpus scan 8 November 2026 v0.13.0 via skillsh Verify on GitHub
D AI-triaged 12
GitHub
D Security

D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →

A Permissions

A set by no findings on this axis

A Transparency

A set by no findings on this axis

showing 10 of 12
securityhigh SD-007
scripts/config.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
securityhigh SD-007
scripts/ensure_env.py
5 suppressed by AI triage
securityhigh SD-007 benign_example
SKILL.md

The line merely warns against using external CLI tools; no outbound network call or permission grant is present.

securityhigh SD-007 benign_example
scripts/config.py

File is prose; outbound call patterns are mentioned as examples, not real network calls.

permission_hygienecritical SD-004 benign_example
scripts/iam/list_permanent_access_keys.py

Accessing a response attribute named 'credentials' is not a file path reference, so it does not indicate credential exposure.

securitymedium SD-008 benign_example
scripts/iam/list_registered_services_for_auth_schema_v5.py

No evidence of malicious or obfuscated behavior; standard SDK import.

securitymedium SD-008 benign_example
scripts/iam/list_registered_services_for_auth_schema_v5.py

Script uses legitimate Huawei Cloud IAM SDK calls without hidden payload.