huaweicloud/huaweicloud-skills huawei-cloud-skill-tester
Checked the catalogued skill at huawei-cloud-skill-tester.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
17 suppressed by AI triage
The flagged line is empty in a manifest; no code is present for injection.
The flagged line is empty; manifest files do not contain executable code.
The flagged line is empty; no shell code can be injected here.
The path shown is a documentation placeholder, not an actual traversal.
Absolute path is part of a skill list in documentation, not a malicious traversal.
Same as finding 2 – documentation only, not a real threat.
Absolute path is part of documentation, not executable code.
Path appears only in test metadata, not used for code execution.
The script downloads installer metadata from Huawei Cloud's official API, which is a normal operation for installing the CLI.
The curl call retrieves a manifest from the same official Huawei Cloud URL, a legitimate part of the installation process.
The curl call fetches the actual CLI package from the official Huawei Cloud endpoint, which is expected and benign.
The function merely constructs a directory path; it does not perform path traversal outside the intended skill directory.
The code only documents how credentials are obtained; it does not modify shell profiles or create persistence.
The script merely tests whether a variable matches an HTTP/HTTPS URL pattern; it does not perform an outbound network call.
The code imports credential classes; it does not read or access credential files.
The line checks if a command starts with curl; it does not perform an outbound call.
Same as above, merely part of a command filter, not an actual network request.