The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Python subprocess module to execute system commands such as hcloud, git, curl, and grep. These are used to collect environment information and perform analysis.\n- [REMOTE_CODE_EXECUTION]: The skill provides an installation guide that suggests downloading and executing a shell script directly from a remote Huawei Cloud OBS bucket (*.myhuaweicloud.com). Piping remote scripts to a shell is a high-risk pattern.\n- [CREDENTIALS_UNSAFE]: The skill workflow explicitly asks the user for Huawei Cloud Access Keys and Secret Keys. These sensitive credentials are used to authenticate the CLI and API calls during the assessment process.\n- [EXTERNAL_DOWNLOADS]: The collect_all.py script performs a git clone operation on a repository URL provided by the user. This allows the skill to download and process external code for Dockerfile best-practice analysis.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from external, untrusted code repositories provided by the user.\n
Ingestion points: The scripts/collect_all.py script clones a Git repository from a user-supplied URL and reads the contents of the Dockerfiles therein.\n
Boundary markers: There are no explicit delimiters or warnings to ignore instructions within the ingested Dockerfile content.\n
Capability inventory: The skill possesses significant capabilities, including executing shell commands, making network requests via curl, and writing reports to the local file system.\n
Sanitization: Analysis is performed by searching for specific patterns using regular expressions, but the data itself is not sanitized before being summarized in the final report.\n- [COMMAND_EXECUTION]: Rule 3 in SKILL.md instructs the agent to use sudo if it encounters permission issues, which effectively grants the process elevated privileges on the host system.

huawei-cloud-cce-env-assessment