The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script scripts/test-cli-commands.sh uses the eval function to execute command strings defined in templates/test-vars.json. While it includes a rudimentary prefix-based whitelist (restricting execution to hcloud, python3, curl, and bash), the use of eval on strings sourced from a configuration file represents a potential command execution surface.
[EXTERNAL_DOWNLOADS]: The references/cli-installation-guide.md documentation provides instructions to download and execute the official Huawei Cloud CLI installation script from the vendor's domain (*.myhuaweicloud.com). This is standard procedure for setting up the required environment and utilizes official vendor infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from security reports and audit logs provided by the HSS API. This data represents an untrusted ingestion surface that could theoretically contain malicious instructions designed to influence the agent's behavior. 1. Ingestion points: Data retrieved from hcloud HSS commands like ListVulnerabilities and ListEventHandleHistory. 2. Boundary markers: None explicitly defined in the skill instructions for API output. 3. Capability inventory: The skill can modify alert handling status via ChangeEvent and ChangeVulStatus. 4. Sanitization: Standard CLI JSON parsing is used without specialized prompt-injection filtering.

huawei-cloud-hss-query