The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via subprocess.run in poll_devkit_status.py to check installation status and uses the paramiko library to run remote installation and verification scripts on the target ECS instance. These actions are restricted to the skill's primary purpose of tool deployment and monitoring.
[EXTERNAL_DOWNLOADS]: The skill fetches the hcloud CLI and Kunpeng DevKit installation packages from official vendor-controlled domains such as obs.cn-north-4.myhuaweicloud.com. These downloads are documented, verified (via signature checks in install_devkit_webui.sh), and trace back to the author's infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill parses logs from the remote installation process to report progress to the user. This involves ingesting data from /tmp/devkit_poll_progress.log. While this creates an attack surface for indirect injection, the logs are generated by the skill's own controlled installer scripts, and the risk is assessed as low.
[SAFE]: The skill demonstrates high security standards for an automation tool, specifically regarding the 'Password Lifecycle'. It ensures that randomly generated credentials remain in process memory and are stored using cloud-native encryption services (KMS) rather than insecure environment variables or CLI arguments.

huawei-cloud-devkit-webui-create