The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the skill-quality-cli utility and recommends the installation of the Huawei Cloud hcloud CLI from official vendor domains (*.myhuaweicloud.com). The skill-quality-cli package is verified using a hardcoded SHA256 hash in scripts/ensure_cli.sh to ensure its integrity.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute hcloud commands. It properly uses list-based arguments, avoiding shell injection risks by not using shell=True.
[CREDENTIALS_SAFE]: The skill retrieves authentication credentials from standard Huawei Cloud environment variables (AK/SK). It includes a redaction mechanism in scripts/sg/common.py to prevent these credentials from being leaked in command output or logs.
[DATA_EXFILTRATION]: Usage telemetry is reported via the skill-quality-cli tool to vendor-owned endpoints. This behavior is transparently disclosed in the SKILL.md file, which also provides instructions for users to opt out using the SKILL_QUALITY_REPORT=0 environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes security group rules which may contain user-controlled text in fields like descriptions. This data is handled by the internal diagnosis and audit logic, posing a low risk of influencing agent behavior.

huawei-cloud-sg-manage