The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/check_koocli.py downloads the Huawei Cloud CLI (hcloud) binary from https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest. This is a vendor-owned resource hosted on Huawei Cloud's Object Storage Service (OBS) and is required for the skill to interact with the cloud environment.
[COMMAND_EXECUTION]: The toolchain extensively uses subprocess.run to execute hcloud commands for resource discovery. Analysis shows it uses list-based command construction (e.g., subprocess.run(['hcloud', 'ECS', ...])), which effectively mitigates shell injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external cloud API responses (resource names, IDs, metadata). While this presents a theoretical injection surface (e.g., a maliciously named cloud resource), the scripts process this data as structured JSON and do not interpolate it into instructions that would modify the agent's behavior. Boundary markers are absent, but standard JSON parsing provides a degree of sanitization.
[DYNAMIC_EXECUTION]: scripts/query_resources.py uses importlib.import_module to dynamically load service-specific query scripts (e.g., query_vpc, query_ecs). These are local modules shipped with the skill. scripts/check_koocli.py also uses __import__ to verify the presence of required Python packages at runtime.

huawei-cloud-architecture-resource-archive