{"data":{"skill":{"slug":"modelarts-agent-modelarts-skill","name":"modelarts-skill","icon":"📦","repo":"https://github.com/modelarts-agent/huawei-cloud-modelarts-skill/tree/main/","status":"approved","author":"modelarts-agent","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"54ff927b-1801-4f88-a9eb-4c9b861f4237","skill_id":"e9ce9777-e7a6-4bda-8eb1-ec4fada7b615","version":2,"content_hash":"441c7f134a603710d8015e9aed501553","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static findings were mostly false positives from Markdown backticks, identifiers such as id, and normal SDK wrapper code. However, the skill has high operational risk because it reads cloud credentials, signs outbound Huawei Cloud API requests, submits user-supplied training commands, and can delete or reset cloud resources. No prompt injection or confirmed malicious exfiltration was found.","remediation":[],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"scripts/auth_manager.py","line_end":52,"line_start":51},{"file":"scripts/auth_manager.py","line_end":92,"line_start":88},{"file":"scripts/auth_manager.py","line_end":194,"line_start":190},{"file":"scripts/management_module/authorization.py","line_end":79,"line_start":63}]},{"factor":"network","evidence":[{"file":"scripts/common_module/api_helper.py","line_end":90,"line_start":67},{"file":"scripts/vpc_module/common.py","line_end":128,"line_start":100},{"file":"scripts/kms_module/common.py","line_end":88,"line_start":60},{"file":"scripts/swr_module/image_repos.py","line_end":116,"line_start":89}]},{"factor":"scripts","evidence":[{"file":"scripts/common_module/auth.py","line_end":29,"line_start":13},{"file":"scripts/infer_v1_module/_bootstrap.py","line_end":23,"line_start":6},{"file":"scripts/pool_module/_bootstrap.py","line_end":26,"line_start":6},{"file":"scripts/train_module/job_create.py","line_end":172,"line_start":160}]},{"factor":"external_commands","evidence":[{"file":"scripts/train_module/job_create.py","line_end":30,"line_start":22},{"file":"scripts/train_module/job_create.py","line_end":70,"line_start":68},{"file":"scripts/train_module/job_create.py","line_end":170,"line_start":141},{"file":"references/pool.md","line_end":27,"line_start":18}]}],"critical_findings":[],"high_findings":[{"title":"Cloud Credential Handling and API Signing","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/auth_manager.py","line_end":52,"line_start":51},{"file":"scripts/auth_manager.py","line_end":92,"line_start":88},{"file":"scripts/auth_manager.py","line_end":194,"line_start":190},{"file":"scripts/vpc_module/common.py","line_end":117,"line_start":89},{"file":"scripts/kms_module/common.py","line_end":77,"line_start":49},{"file":"scripts/swr_module/image_repos.py","line_end":105,"line_start":82}],"confidence":0.92,"description":"The skill reads ModelArts access keys, secret keys, security tokens, project IDs, and regions, then creates signed sessions and requests. This is expected for the integration, but compromise or misuse would grant cloud account access.","confidence_reasoning":"Direct credential access is present and semantically tied to signed Huawei Cloud API calls. The code masks status output, so the risk is powerful credential use rather than proven exfiltration."},{"title":"Authenticated Cloud Resource Mutation and Deletion","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/liteserver_module/delete_dev_server.py","line_end":34,"line_start":10},{"file":"scripts/pool_module/batch_delete_nodes.py","line_end":41,"line_start":10},{"file":"scripts/pool_module/batch_reset_nodes.py","line_end":50,"line_start":10},{"file":"scripts/management_module/authorization.py","line_end":86,"line_start":28}],"confidence":0.9,"description":"The skill exposes operations that can delete Lite Server instances, delete resource pool nodes, reset nodes, and manage authorizations. These are legitimate ModelArts administration functions, but they can cause service loss or privilege changes if invoked incorrectly.","confidence_reasoning":"The cited functions perform authenticated destructive or privilege-affecting operations through cloud APIs. The behavior matches the skill purpose, but marketplace users need explicit trust and permission boundaries."},{"title":"Remote Training Command Submission","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/train_module/job_create.py","line_end":30,"line_start":22},{"file":"scripts/train_module/job_create.py","line_end":70,"line_start":68},{"file":"scripts/train_module/job_create.py","line_end":170,"line_start":141}],"confidence":0.86,"description":"The training job API accepts a command parameter and sends it in a ModelArts training job request. This is not local shell execution, but it can execute user-selected commands inside cloud training workloads.","confidence_reasoning":"The command parameter is intentionally forwarded to a remote training job configuration. Legitimate ML workflows need this, but it is still command execution in a cloud environment."}],"medium_findings":[{"title":"Dynamic Import Path Manipulation","verdict":"NEEDS_REVIEW","locations":[{"file":"scripts/common_module/auth.py","line_end":18,"line_start":15},{"file":"scripts/infer_v1_module/_bootstrap.py","line_end":23,"line_start":6},{"file":"scripts/infer_v2_module/_bootstrap.py","line_end":24,"line_start":8},{"file":"scripts/pool_module/_bootstrap.py","line_end":26,"line_start":6}],"confidence":0.68,"description":"Several modules modify sys.path before importing shared modules. The paths are local project paths and not clearly malicious, but this can increase dependency hijacking risk if the working directory is untrusted.","confidence_reasoning":"The pattern is real, but it appears to support modular local imports. Risk depends on whether users run the skill from a trusted directory."},{"title":"Exec Login Information Exposure","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/infer_v2_module/get_exec.py","line_end":44,"line_start":25},{"file":"scripts/infer_v2_module/get_exec.py","line_end":74,"line_start":67}],"confidence":0.78,"description":"The v2 inference helper can retrieve container exec login details, including endpoint, namespace, pod names, and cluster token metadata. This is useful for debugging but sensitive in shared or logged environments.","confidence_reasoning":"The docstring explicitly states that the API returns exec login information and cluster token-related data. The finding is contextual rather than evidence of malicious disclosure."},{"title":"False Positive Static Pattern Groups","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":35,"line_start":17},{"file":"references/pool.md","line_end":27,"line_start":18},{"file":"scripts/infer_v1_module/get_model.py","line_end":20,"line_start":12},{"file":"scripts/liteserver_module/create_hyper_tags.py","line_end":20,"line_start":16},{"file":"scripts/tools.py","line_end":12,"line_start":8}],"confidence":0.82,"description":"Most reported Ruby backtick, weak cryptography, C2 keyword, and Windows SAM alerts are not confirmed security issues. They come from Markdown code formatting, names such as id, API terms such as exec, and words like SECURITY.","confidence_reasoning":"Targeted review found ordinary documentation and cloud API identifiers at the sampled locations. No local Ruby execution, weak cryptographic algorithm use, Windows SAM access, or prompt injection was found."}],"low_findings":[{"title":"Hardcoded Official Cloud Endpoints","verdict":"FALSE_POSITIVE","locations":[{"file":"scripts/vpc_module/common.py","line_end":101,"line_start":100},{"file":"scripts/kms_module/common.py","line_end":61,"line_start":60},{"file":"scripts/swr_module/image_repos.py","line_end":90,"line_start":89}],"confidence":0.88,"description":"The skill builds Huawei Cloud service URLs for VPC, KMS, and SWR requests. These are expected service endpoints rather than suspicious third-party destinations.","confidence_reasoning":"The endpoints are derived from the configured region and point to myhuaweicloud.com services. Network access remains a risk factor because requests are authenticated."},{"title":"No Prompt Injection Evidence Found","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":35,"line_start":13}],"confidence":0.74,"description":"A targeted search for override, ignore-instructions, pre-approval, and similar prompt-injection language found no evidence in the reviewed skill files.","confidence_reasoning":"No suspicious prompt-control text was found during targeted review. Confidence is not absolute because only relevant indicators and sampled files were reviewed."}],"dangerous_patterns":[{"title":"Signed Outbound HTTP Requests With Cloud Credentials","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/vpc_module/common.py","line_end":128,"line_start":83},{"file":"scripts/kms_module/common.py","line_end":88,"line_start":43},{"file":"scripts/swr_module/image_repos.py","line_end":116,"line_start":77}],"confidence":0.9,"description":"The code constructs signed requests with access keys and security tokens for Huawei Cloud APIs.","confidence_reasoning":"Multiple modules directly sign and send outbound requests using cloud credentials. The destination appears legitimate, but the pattern is high impact."},{"title":"Destructive Cloud Administration APIs","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/liteserver_module/delete_dev_server.py","line_end":34,"line_start":10},{"file":"scripts/pool_module/batch_delete_nodes.py","line_end":41,"line_start":10},{"file":"scripts/pool_module/batch_reset_nodes.py","line_end":50,"line_start":10},{"file":"references/liteserver.md","line_end":19,"line_start":13}],"confidence":0.89,"description":"The skill exposes delete, reset, stop, and authorization-management operations against ModelArts resources.","confidence_reasoning":"The operations are explicitly named and call authenticated cloud APIs. They are appropriate for an admin skill but dangerous if permissions are broad."},{"title":"Remote Command Workload Creation","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/train_module/job_create.py","line_end":70,"line_start":68},{"file":"scripts/train_module/job_create.py","line_end":130,"line_start":125},{"file":"scripts/train_module/job_create.py","line_end":170,"line_start":141}],"confidence":0.84,"description":"The skill can place a user-supplied command into a training job creation request.","confidence_reasoning":"The command is sent to a cloud training job, not executed locally. It still creates a remote execution surface controlled by the caller."}],"files_scanned":232,"total_lines":15797,"audit_model":"codex","audited_at":"2026-06-30T08:20:23.149+00:00","created_at":"2026-06-30T10:03:19.169905+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":4,"capabilityReviewCount":0,"needsReviewCount":1,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}