The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the official Huawei Cloud CLI (KooCLI) installation script from a vendor-controlled domain (https://hwcloudcli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh). This is standard procedure for installing official cloud management tools.
[REMOTE_CODE_EXECUTION]: The documentation suggests piping the downloaded vendor installation script directly into a shell (bash hcloud_install.sh). While this is remote code execution, it targets a trusted vendor source and is the official installation method.
[OBFUSCATION]: The script scripts/_env_compat.sh uses indirect variable assignment (e.g., export "${_env_name}=${_env_value}") to set environment variables. The script comments explicitly state this is intended to avoid security scanner false positives that trigger on standard credential export patterns. While this is a bypass technique for static analysis, it is used here for legitimate compatibility between different environment variable naming standards.
[COMMAND_EXECUTION]: The skill relies on shell scripts that wrap the hcloud CLI. It uses python3 -c one-liners in several scripts (list_ecs.sh, list_alarms.sh, batch_query_metrics.sh) to parse JSON output and format it for the user. These commands are static and do not interpolate unsanitized user input into the command string.
[DYNAMIC_EXECUTION]: The scripts/config.py module uses subprocess.run() to execute hcloud configure list to retrieve existing configuration. This is used to load credentials when environment variables are not present.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests data from external API outputs (ECS instance names, alarm metadata) which are then presented to the agent.
Ingestion points: Data enters via hcloud command outputs in list_ecs.sh, list_alarms.sh, and batch_query_metrics.sh.
Boundary markers: The skill does not implement specific delimiters for external data in the prompt context.
Capability inventory: The skill can perform write operations such as hcloud CES CreateAlarmRules and hcloud SMN AddSubscription.
Sanitization: Data is parsed via Python's json module before display, but no string sanitization is applied to resource names or descriptions returned by the cloud provider.

huawei-cloud-ecs-alert