The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/spawn-detached.mjs to launch local projects (e.g., npm run dev) and scripts/preflight.sh or preflight.ps1 to perform system-level installations and environment setup using yum, apt-get, and pip.
[EXTERNAL_DOWNLOADS]: The skill programmatically downloads external binaries and assets necessary for its operation. This includes fetching the hcloud CLI binary from Huawei Cloud OBS storage, the gitcode-oauth utility from GitCode, and Noto Color Emoji fonts from Huawei Cloud npm mirrors and jsDelivr.
[CREDENTIALS_UNSAFE]: The skill manages several types of sensitive information: it reads ~/.git-credentials and uses the Windows cmdkey utility to detect GitCode authentication tokens, and it uses scripts/gen_sts.py to generate and save temporary Huawei Cloud IAM STS credentials to local files (sts-creds.json, sts-creds.sh) for platform authentication.
[DYNAMIC_EXECUTION]: The scripts/spawn-detached.mjs utility allows the agent to execute arbitrary detached processes on the host system using setsid on Linux and Win32_Process.Create via WMI on Windows. This is used to run the user's application locally so it can be screenshotted by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's local project files, such as README.md and project manifests. These contents are used to extract information like project names and descriptions, which are then interpolated into API requests and agent prompts.

huawei-cloud-publish-work-to-gallery