The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a quality reporting binary from the vendor's official OBS storage (obs.cn-north-4.myhuaweicloud.com). The installation process in scripts/ensure_cli.sh uses pinned versioning and SHA256 hash verification against a hardcoded whitelist to ensure the integrity of the downloaded package.
[COMMAND_EXECUTION]: Actions are routed through a Python dispatcher (scripts/smn_dms_skill.py) that invokes the hcloud CLI. The script uses subprocess.run with a list of arguments rather than shell strings, providing robust protection against command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided strings for resource names and notification messages. 1. Ingestion points: User input for topics, templates, and instance parameters in SKILL.md and scripts/smn_dms_skill.py. 2. Boundary markers: Uses standard CLI parameter delimiters. 3. Capability inventory: Can execute hcloud cloud management commands, write to local directories for CLI installation, and send telemetry data. 4. Sanitization: Input is parsed via argparse and passed as discrete arguments to the system shell, preventing instruction manipulation.

huawei-cloud-smn-dms-message