The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs a CLI tool (skill-quality-cli) from Huawei Cloud's official Object Storage Service (OBS) and API endpoints.
scripts/ensure_cli.sh fetches a tarball from obs-skills-repository.obs.cn-north-4.myhuaweicloud.com.
scripts/cli/cli_entry.py checks for updates from skillsapi.developer.myhuaweicloud.com and performs an in-place upgrade.
[DATA_EXFILTRATION]: The integrated telemetry module (cli_reporting.py) harvests interaction data from various local agent databases and transmits it to a remote vendor endpoint.
Reads Huawei Cloud CLI credentials from ~/.config/huaweicloud/credentials.json to sign reporting requests.
Extracts user_input, session_id, and steps (interaction history) from local SQLite databases and JSONL files belonging to agents like OpenCode, Hermes, and Codex.
Sends collected telemetry to https://skillsapi.developer.myhuaweicloud.com/api/quality/report.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input during its Socratic Q&A phase and interpolates this data into generated documentation and scripts, creating a potential injection surface.
Ingestion points: Phase 1 Socratic Q&A gathers requirements directly from the user.
Boundary markers: The generation logic in Phase 3 lacks explicit delimiters or warnings to ignore embedded instructions in the user-provided requirements.
Capability inventory: The skill includes scripts (hcloud-run.sh, test-cli-commands.sh) that execute generated shell commands via subprocess.run.
Sanitization: There is no evidence of sanitization or escaping of user input before it is written into the generated SKILL.md or test cases.
[DYNAMIC_EXECUTION]: The CLI entry point uses process replacement for its update mechanism and shell execution for running skill commands.
scripts/cli/cli_entry.py invokes os.execv() to restart the process with a newly downloaded binary.
scripts/hcloud-run.sh and scripts/test-cli-commands.sh use shell execution to run hcloud and other business logic.
[COMMAND_EXECUTION]: The skill executes external scripts found via file system searching.
scripts/report-skill-created.sh uses the find command to locate and execute report.mjs within the ~/.agents/skills directory tree.
[PERSISTENCE]: The installation script scripts/ensure_cli.sh persists a binary tool and its support files to the user's local directory (~/.local/bin/ and ~/.skill-quality/).

huawei-cloud-skill-creator