Skills/ClawHub/huawei-cloud-oa-risk-inspection

huawei-cloud-oa-risk-inspection@1.0.0

VERIFIED

Publisher claims: "Huawei Cloud tenant risk inspection SKILL for OA, Config and SecMaster services. Use this skill when the user wants to inspect risk from OA, Config and SecMaster services, and generate inspection report in form of HTML and Excel Trigger: User mentions "风险巡检", "风险检查", "资源合规"，"基线检查"" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huaweicloudskill · joined 12 days agoInstalls 172Last detonated 6d ago
$clawhub install huawei-cloud-oa-risk-inspection
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedscripts/merge_report_generator.py:1245 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/secmaster_baseline_inspection.py:132 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/oa_risk_inspection.py:217 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/config_compliance_inspection.py:233 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionassets/echarts.part_001.js:35 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionassets/echarts.part_002.js:1 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07