huaweicloud/huaweicloud-skills › huawei-cloud-openviking-agent-integration

The file is documentation, and the flagged post‑install hook appears to be an example configuration rather than executable code.

The content is part of documentation, describing a persistence mechanism example rather than actual configuration.

Same as above – a documented reference, not executable code.

The file is documentation and the outbound call is an example, not executable code.

The script only assigns a local URL to a variable; no network call is performed.

The URL is used only in a string assignment, not executed as a network request.

Uses /tmp for temporary staging, a standard benign pattern

Creates a temp directory under /tmp, no path traversal

Temporary build directory under /tmp, benign

Reverts state directory to /tmp/.openclaw, a safe temp path

Sets env.yaml state dir to /tmp/.openclaw, benign

Same as previous, benign temp path usage

Placeholder config file with no actual outbound network call.

The file is documentation and only references a path traversal pattern, not executable code.

The script resolves a relative path within its own directory to locate a helper Python file, which does not expose system directories or allow arbitrary file access.

The content is documentation describing a detection, not an actual outbound network call or permission grant.

Documentation file; no executable path traversal found.

The relative path traversal resolves only within the intended shared directory inside the sandbox, not to system directories.

Creates a temporary build directory in /tmp for plugin installation, which is a normal operation and not a malicious path traversal.

Sets the npm registry to a public mirror for downloading plugin packages, a legitimate outbound network call.

Checks and rewrites state directory configuration to avoid using the old /tmp/.openclaw path, a normal configuration fix.

Fixes env.yaml to replace the legacy /tmp/.openclaw path with a dynamic persistent path, a benign adjustment.

Repeats the same benign env.yaml replacement logic, not a malicious path traversal.

Hardcoded absolute path is used only for string replacement in a config file, not for file traversal.

Absolute path is inserted into a YAML string; no file access occurs.

Absolute path appears only in a string literal used for PATH modification, not for traversal.

The path is part of a hardcoded PATH string; no file I/O is performed.

The absolute path is used in a string for a marker; no traversal or file access is performed.

Absolute path is matched in a regex for removal; no traversal or file access occurs.

Same as above; only string manipulation.

Absolute path used in regex substitution; no file traversal.

Pattern matches a hardcoded string; no traversal or file access occurs.

No path traversal string is present in the context, just empty lines.

The file is documentation and the match appears to be a placeholder, not an actual path traversal.

Documentation context, not actual file operation.

The line references a local URL in help text; it is merely documentation, not an actual outbound call.