The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess.run module to execute system commands like hcloud and kubectl. These calls use list-based arguments without shell=True, which reduces the risk of shell injection. Parameters like namespace are validated against a strict regex pattern before being passed to the command line.
[EXTERNAL_DOWNLOADS]: The documentation (references/kubectl-cce.md) instructs users to download and install the kubectl-cce plugin from an untrusted personal GitHub repository (github.com/pancake0001/kubectl-cce-plugin). This binary is used by the skill for cluster discovery and as a fallback access method. Executing unverified third-party binaries poses a supply chain risk.
[CREDENTIALS_SAFE]: The skill handles Huawei Cloud credentials (AK/SK) through environment variables or explicit tool parameters. It includes a redact_command utility in scripts/huawei_cloud/common.py to mask these values in logs or command outputs, preventing accidental credential exposure.
[DATA_EXFILTRATION]: The skill implements logic to write temporary kubeconfig files to local disk for kubectl execution. These files are correctly created using tempfile.NamedTemporaryFile and are deleted in finally blocks to ensure sensitive data is not persisted on the filesystem.

huawei-cloud-cce-kubernetes-event-analyzer