中文 EN
Start Review
Skill Trust Decision

huawei-cloud-apig-instance-management

华为云官方 APIG 管理技能，附带未声明的华为云遥测 SDK（内部质控工具），无恶意行为但存在文档缺失

Install decision first Source: ClawHub Scanned: Sep 11, 2026
Files 7
Artifacts 4
Violations 2
Findings 3

Why this conclusion was reached

1/4 dimensions flagged
Block
Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

4 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

文档未声明遥测 SDK +15

scripts/skill_quality_sdk.py 不在 SKILL.md 中提及，构成阴影功能

外部数据上报 +10

输入/输出脱敏后上报至 https://skillsapi.developer.myhuaweicloud.com/api/quality/report

Most important evidence

Medium Doc Mismatch

遥测 SDK 未在 SKILL.md 中声明

scripts/skill_quality_sdk.py 存在但 SKILL.md 完全未提及。该 SDK 在 Skill 执行后自动上报 trace_id/耗时/状态/脱敏入参/堆栈至华为云运营平台，构成阴影功能。

scripts/skill_quality_sdk.py:1
在 SKILL.md 的 Prerequisites 或 Reference Documents 章节声明该 SDK 的存在、上报端点和禁用方式（SKILL_QUALITY_DISABLE=1）
Low Data Exfil

执行数据上报至外部端点

SDK 将脱敏后的输入参数、输出结果、错误堆栈上报至 https://skillsapi.developer.myhuaweicloud.com/api/quality/report。虽数据已脱敏（手机号、密钥、AK-SK），但 SKILL.md 未声明此行为。

scripts/skill_quality_sdk.py:36
如该 Skill 不需要华为云运营质控，在部署环境设置 SKILL_QUALITY_DISABLE=1
Low Supply Chain

依赖仅使用 Python 标准库

skill_quality_sdk.py 声明零第三方依赖，仅使用 Python 3 标准库（urllib、ssl、json、logging 等），无供应链风险。

scripts/skill_quality_sdk.py:1
无需行动

Declared capability vs actual capability

Shell Pass
Declared WRITE
→
Inferred WRITE
SKILL.md 声明 hcloud CLI 调用，scripts/skill_quality_sdk.py 不涉及 shell
Network Block
Declared READ
→
Inferred WRITE
SKILL.md 未声明网络上报行为；scripts/skill_quality_sdk.py:36 向 skillsapi.developer.myhuaweicloud.com POST 数据
Environment Pass
Declared READ
→
Inferred READ
AK/SK 读取与 SKILL.md 声明的鉴权方式一致；SDK 额外读取 HUAWEICLOUD_SDK_AK/HW_ACCESS_KEY 等华为云标准变量
Skill Invoke Block
Declared NONE
→
Inferred WRITE
SDK 装饰器 @quality_report() 可包裹任意函数执行遥测上报，SKILL.md 未提及此机制

Suspicious artifacts and egress

Medium External URL
https://support.huaweicloud.com/apig/

SKILL.md:441

Medium External URL
https://support.huaweicloud.com/qs-hcli/hcli_02_003.html

references/cli-installation-guide.md:6

Medium External URL
https://cn-north-4-hww-cloud-download.obs.cn-north-4.myhuaweicloud.com/cli/hcloud_install.sh

references/cli-installation-guide.md:10

Medium External URL
https://skillsapi.developer.myhuaweicloud.com/api/quality/report

scripts/skill_quality_sdk.py:16

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
无第三方依赖 N/A Python 3 标准库 No 仅使用 urllib、ssl、json、logging、functools、traceback 等标准库模块

File composition

7 files · 1292 lines
Markdown 6 files · 775 linesPython 1 files · 517 lines
Files of concern · 3
SKILL.md Markdown · 440 lines
https://support.huaweicloud.com/apig/
scripts/skill_quality_sdk.py Python · 517 lines
遥测 SDK 未在 SKILL.md 中声明 · 执行数据上报至外部端点 · 依赖仅使用 Python 标准库 · https://skillsapi.developer.myhuaweicloud.com/api/quality/report
references/cli-installation-guide.md Markdown · 92 lines
https://support.huaweicloud.com/qs-hcli/hcli_02_003.html · https://cn-north-4-hww-cloud-download.obs.cn-north-4.myhuaweicloud.com/cli/hcloud_install.sh
Other files · verification-method.md · acceptance-criteria.md · iam-policies.md · dataflow-diagram.md

Security positives

skill_quality_sdk.py 内置脱敏逻辑，覆盖手机号、密钥、AK-SK 等敏感字段
遥测上报端点为华为云官方域名（myhuaweicloud.com），非第三方
代码无 Base64/eval/混淆等反分析技术
无访问 ~/.ssh、~/.aws、.env 等敏感路径
无凭证收割或远程代码执行行为
使用 Python 标准库，无恶意第三方依赖
SKILL.md 权限分级清晰（R1/R2/R3），删除操作要求显式确认
IAM Token 缓存机制合理，缓存过期自动刷新