⚠️ Security Rules:

1. AK/SK MUST be passed via environment variables. NEVER expose AK/SK/Password in plaintext.
2. 🔴 No Plaintext Passwords in AI Output: DEVKIT_ECS_PASSWORD value and nodes.conf plaintext ssh_pass values MUST NEVER appear in plaintext anywhere in AI-generated content — including chat responses, internal thinking/reasoning, tool call arguments, command examples, error messages, debug output, and status reports. Always mask as *** or use placeholders (<your_password>, <encrypted_password>). This is a hard prohibition with zero exceptions.
3. 🔴 nodes.conf Password Masking: To safely display nodes.conf content, run bash ${DEVKIT_HOME}/encrypt-nodes-verify.sh --mask on the DevKit server (outputs all ssh_pass values masked as ***). NEVER cat/grep/sed nodes.conf directly into chat output.
4. 🔴 Mandatory Encryption Replacement: Before any scan, AI MUST run encrypt-nodes-verify.sh on the DevKit server to encrypt plaintext ssh_pass via sys-mig -ec and replace plaintext values in nodes.conf with encrypted ones. NEVER execute devkit sys-mig scan commands while nodes.conf still contains plaintext passwords.
5. 🔴 DEVKIT_ECS_PASSWORD Masking: The DevKit server password (DEVKIT_ECS_PASSWORD env var value) MUST NEVER appear in plaintext in any AI output (chat, thinking, tool calls, logs). Always mask as *** or <your_password>. Command examples must use ${DEVKIT_ECS_PASSWORD} (variable reference), never the actual value.
6. 🔴 No Temporary Scripts: NEVER use the Write tool to create temporary script files (e.g., _exec_scan.py, _rename.py, etc.). All commands must use inline execution (py -c, bash -c, etc.) or call existing scripts directly.
7. 🔴 Prefer Inline Execution: When executing Python code, prefer py -c "..." inline mode instead of creating temporary .py files.
8. 🔴 Return Errors Only on Failure: When a command fails, only return the error message for user troubleshooting. NEVER rewrite scripts, NEVER print full commands, NEVER auto-retry. Let the user decide next steps.
9. 🔴 Parameter Confirmation: Before executing ANY command or API call, ALL parameters MUST be explicitly confirmed by the user. NO defaults. NO implicit assumptions. NO execution without explicit user approval. Parameters requiring confirmation: Region (user selects from 4 options each time, no cache/reuse), Network (VPC/subnet/security group names, CIDR), ECS (instance name, flavor, OS image, adminPass source), Credentials (DEVKIT_ECS_USER/DEVKIT_ECS_PASSWORD), Scan (mode, path, report path, log level), Report (local download path). Confirmation flow: AI collects parameters → presents summary → asks "Confirm above parameters? (yes/no)" → user explicitly says yes → execute; user says no or no response → do NOT execute. NEVER execute with unconfirmed parameters, assumed defaults, or without explicit user approval.
10. 🔴 Display Language: ALL user-facing display content MUST be in Simplified Chinese. This includes: configuration instructions and prompts (e.g., AK/SK setup guides, network configuration, ECS parameters), parameter confirmation summaries, error messages and troubleshooting suggestions, step progress notifications and status reports, scan type selection options and descriptions, and any text output intended for the user to read. NEVER display English instructions, prompts, or descriptions to the user. When referencing English content from reference documents, AI MUST translate it to Simplified Chinese before displaying to the user. Technical terms (e.g., hcloud, AK/SK, VPC, ECS, EIP, SSH, SFTP, nodes.conf, DevKit) and command syntax remain in English.
11. 🔴 No Guessing — Always Consult Skill Documents: Before executing ANY operation (especially scan commands, ECS creation, script execution, parameter templates), AI MUST first read the relevant skill reference documents (e.g., references/devkit-operations-guide.md, references/ecs-creation.md, references/devkit-operations-workflow.md) to obtain the correct command templates, parameter names, and formats. NEVER guess or fabricate command parameters, command templates, API parameters, or file paths from memory or assumptions. NEVER present command templates to the user without first verifying them against the skill documentation. If unsure about a command or parameter, read the corresponding reference document first. This rule applies to ALL steps: scan command templates (stmt/sbom/mvn_analyse/container_mig), ECS creation parameters, network configuration, script execution, etc.
12. 🔴 No Re-run of Create Commands: NEVER re-run any create command (CreateServers, CreateVpc, etc.) if the first call's output parsing fails or returns empty. The resource was likely already created. Instead, query existing resources by name to find the created resource. Re-running create commands produces duplicate resources, wasting quota and incurring costs.

See Security Rules.

huawei-cloud-devkit-application-check-cli