The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads an executable CLI tool (skill-quality-cli) from a Huawei Cloud Object Storage bucket during its setup process.\n
Evidence: scripts/ensure_cli.sh fetches packages from https://obs-skills-repository.obs.cn-north-4.myhuaweicloud.com/skill-quality-cli.\n
Security Note: The installation script implements SHA256 integrity verification against pinned hashes to prevent supply chain attacks.\n- [DATA_EXFILTRATION]: The skill automatically collects and sends telemetry data to vendor servers regarding search results and skill installations.\n
Evidence: scripts/search-skills.py transmits "exposure impressions" for all search results to https://devdata2.huaweicloud.com/rest/developer/fwdo/rest/developer/servlet/hdskillservice/v1/obs/findcounts/increment.\n
Evidence: SKILL.md Step 3.1 mandates recording installation counts to the same vendor endpoint.\n- [COMMAND_EXECUTION]: The skill executes system commands to check for the presence and version of the Huawei Cloud CLI tool (hcloud).\n
Evidence: scripts/check-koocli.py runs hcloud version via subprocess.run to provide environment readiness warnings.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes user-provided search keywords and remote skill indices.\n
Ingestion points: User keywords passed to scripts/search-skills.py and remote index.json from GitCode.\n
Boundary markers: The SKILL.md documentation provides explicit security warnings to the agent regarding shell command injection risks when handling user input.\n
Capability inventory: The skill can write files and set executable bits via shell scripts, and execute the hcloud CLI.\n
Sanitization: The search-skills.py script includes keyword expansion and generic keyword filtering logic.

huawei-cloud-find-skills