This is a legitimate Huawei Cloud ModelArts integration skill. All 1169 static findings were evaluated: the vast majority are false positives in Markdown documentation files showing CLI command examples (577 external_commands hits). Critical findings for Windows SAM database and C2 keywords are false positives matching Huawei Cloud project IDs and unrelated comments. The code has a well-designed security model with credential isolation - API keys are stored in memory and masked before any LLM-facing output. Real concerns are limited to expected cloud SDK behaviors: environment variable access for credentials and network calls to Huawei Cloud APIs.
The skill reads environment variables for ModelArts access keys (AK/SK) and project configuration. This is expected for a cloud SDK integration but represents a real security consideration. The code properly masks credentials before returning data to the LLM.
The skill makes HTTP requests to Huawei Cloud ModelArts API endpoints. This is expected functionality for a cloud platform integration skill. All requests are to documented Huawei Cloud API endpoints using authenticated sessions.
A Huawei Cloud project ID (0f2788726a80f4ec2fecc00b5844a0c2) is hardcoded as a default parameter value and in documentation examples. While a project ID is not a secret credential, hardcoding internal identifiers is a data leakage concern.