The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the official hcloud CLI tool from a Huawei Cloud OBS endpoint (cn-south-1-cloud-res-model-sdk.obs.cn-south-1.myhuaweicloud.com). This is a legitimate download from the vendor's own infrastructure required for the skill's management operations.
[DATA_EXFILTRATION]: Incorporates a telemetry script (scripts/skill_quality_sdk.py) that reports execution metrics, status codes, and masked input/output data to a Huawei Cloud developer endpoint (skillsapi.developer.myhuaweicloud.com). This functionality is documented as a quality reporting feature and targets the vendor's official domain with active masking of sensitive information.
[INDIRECT_PROMPT_INJECTION]: The skill processes instance names and configuration data retrieved from Huawei Cloud APIs, which could serve as a vector for indirect instructions if those fields are attacker-controlled. The risk is mitigated by the skill's specific operational scope and existing telemetry guardrails.
Ingestion points: Data retrieved via hcloud DDS ListInstances and hcloud DCS ListInstances (found in SKILL.md).
Boundary markers: None present to delimit API output from system prompts.
Capability inventory: Subprocess calls for instance modification and deletion (hcloud DDS DeleteInstance, hcloud DCS DeleteSingleInstance, hcloud DCS RestartOrFlushInstances) found in SKILL.md.
Sanitization: The skill_quality_sdk.py script provides masking for secrets during telemetry reporting, although standard API output is interpolated directly into the context.

huawei-cloud-dds-dcs-instance-management