中文 EN
Start Review
Skill Trust Decision

huawei-cloud-rds-list

合法的华为云RDS实例查询技能，存在未充分披露的外部遥测上报功能和curl-to-bash安装方式，但已在skill-card.md中声明风险，可通过环境变量禁用遥测。

Install decision first Source: ClawHub Scanned: Aug 9, 2026
Files 12
Artifacts 5
Violations 1
Findings 3

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

2 dependency or supply-chain issues need attention.

What drove the risk score up

外部遥测上报未在SKILL.md充分披露 +15

skill_quality_sdk.py向https://skillsop.topxtopx.com/api/quality/report上报输入参数和执行结果，虽在skill-card.md声明为已知风险，但SKILL.md未详细说明数据类型和端点

curl-to-bash安装方式存在供应链风险 +5

references/cli-installation-guide.md第8行使用curl|bash从华为云OBS下载CLI安装脚本，虽在skill-card.md中声明为已知风险，但仍是危险模式

读取环境变量中的云凭证 +5

_run_sdk函数读取HUAWEI_ACCESS_KEY/HUAWEI_SECRET_KEY环境变量用于API认证，虽为必要操作，但属于敏感访问

Most important evidence

Medium Doc Mismatch

外部遥测上报功能披露不充分

scripts/skill_quality_sdk.py向外部端点skillsop.topxtopx.com上报trace_id、输入参数、输出结果、错误堆栈等数据。SKILL.md第22-23行简述了质量上报，但未说明具体数据类型、外部端点URL和数据处理方式。完整披露仅见于skill-card.md第11-14行的Known Risks章节。

SKILL.md:22
在SKILL.md的Prerequisites或独立数据安全章节中详细说明遥测数据类型、外部端点和禁用方式（SKILL_QUALITY_DISABLE=1）
Medium Supply Chain

curl-to-bash远程脚本执行

references/cli-installation-guide.md第8行包含从华为云OBS存储桶下载并直接bash执行安装脚本的命令：curl -sSL https://cn-north-4-hcli-cloud.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh | bash。虽在skill-card.md第17-18行声明为已知风险并建议替代方案，但该模式仍存在供应链攻击风险。

references/cli-installation-guide.md:8
优先使用包管理器安装（choco/brew），或在文档中提供SHA256校验和脚本指纹验证方式
Low Sensitive Access

环境变量读取云凭证

scripts/list_rds_instances.py的_run_sdk函数读取HUAWEI_ACCESS_KEY/HUAWEI_SECRET_KEY或HUAWEICLOUD_SDK_AK/HUAWEICLOUD_SDK_SK环境变量用于API认证。虽然这是调用华为云SDK的必要操作，但属于敏感凭据访问。代码正确处理了凭据（仅用于SDK调用，未外传），且有错误提示。

scripts/list_rds_instances.py:73
已在iam-policies.md中说明使用最小权限IAM用户，建议在SKILL.md的Prerequisites章节补充此说明

Declared capability vs actual capability

Network Pass
Declared READ
→
Inferred READ
scripts/list_rds_instances.py:73-87 调用华为云RDS API
Shell Pass
Declared NONE
→
Inferred READ
scripts/list_rds_instances.py:50-78 subprocess.run执行hcloud CLI命令，文档中有声明
Environment Pass
Declared NONE
→
Inferred READ
scripts/list_rds_instances.py:73-74 读取AK/SK用于华为云API认证，SDK必要
Filesystem Pass
Declared NONE
→
Inferred NONE
无文件写入操作，仅读取引用文档
Skill Invoke Block
Declared NONE
→
Inferred WRITE
scripts/skill_quality_sdk.py:19-22 调用外部端点https://skillsop.topxtopx.com/api/quality/report上报执行质量

Suspicious artifacts and egress

Critical Dangerous Command
curl -sSL https://cn-north-4-hcli-cloud.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh | bash

references/cli-installation-guide.md:8

Medium External URL
https://cn-north-4-hcli-cloud.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh

references/cli-installation-guide.md:8

Medium External URL
https://skillsop.topxtopx.com/api/quality/report

scripts/skill_quality_sdk.py:16

Medium External URL
https://clawhub.ai/user/erickeyhu-hug

skill-card.md:9

Medium External URL
https://clawhub.ai/erickeyhu-hug/skills/huawei-cloud-rds-list

skill-card.md:44

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
huaweicloudsdkcore 未指定 pip No 官方华为云SDK，requirements.txt中未锁定版本
huaweicloudsdkrds 未指定 pip No 官方华为云RDS SDK，requirements.txt中未锁定版本

File composition

12 files · 1394 lines
Python 2 files · 635 linesMarkdown 7 files · 470 linesShell 2 files · 242 linesJSON 1 files · 47 lines
Files of concern · 5
scripts/skill_quality_sdk.py Python · 388 lines
https://skillsop.topxtopx.com/api/quality/report
scripts/list_rds_instances.py Python · 247 lines
环境变量读取云凭证
SKILL.md Markdown · 179 lines
外部遥测上报功能披露不充分
skill-card.md Markdown · 63 lines
https://clawhub.ai/user/erickeyhu-hug · https://clawhub.ai/erickeyhu-hug/skills/huawei-cloud-rds-list
references/cli-installation-guide.md Markdown · 60 lines
curl-to-bash远程脚本执行 · curl -sSL https://cn-north-4-hcli-cloud.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh | bash · https://cn-north-4-hcli-cloud.obs.cn-north-4.myhuaweicloud.com/hcli/install.sh
Other files · test-cli-commands.sh · validate-skill.sh · acceptance-criteria.md · verification-method.md · test-vars.json · dataflow-diagram.md +1

Security positives

技能功能单一且声明清晰，仅查询RDS实例列表，无创建/修改/删除操作
提供了CLI和SDK两种执行方式，有完善的回退机制
包含质量上报禁用开关（SKILL_QUALITY_DISABLE=1），尊重用户隐私
skill-card.md主动披露了已知风险，显示发布者有安全意识
代码质量较高，包含完善的错误处理和超时控制
无硬编码凭证，符合最佳实践
使用标准华为云SDK，非自制加密或混淆代码