@raishin/vanguard-frontier-agentic 1.5.0 → 1.7.0

package/skills/huawei/huawei-maestro/metadata.json

@@ -0,0 +1,20 @@
+{
+  "id": "huawei-maestro",
+  "name": "Huawei Cloud Maestro",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": ["codex", "copilot", "claude-code", "cursor", "gemini", "kiro"],
+  "summary": "Route Huawei Cloud tasks to the narrowest specialist or team of specialists from the 27-agent catalog. MLPS 2.0 and sovereignty-aware — flags MLPS Level 3 control gaps and data residency obligations for China workloads. Understands Huawei's enterprise-project model and SCP-based org governance. Never auto-dispatches live-guard agents.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/iam/index.html",
+    "https://support.huaweicloud.com/intl/en-us/vpc/index.html",
+    "https://support.huaweicloud.com/intl/en-us/ecs/index.html",
+    "https://support.huaweicloud.com/intl/en-us/secmaster/index.html"
+  ],
+  "security_notes": "Maestro must never auto-dispatch live-guard agents. SCP deny statements and DEW key deletion are irreversible with org-wide or permanent data-loss blast radius. MLPS 2.0 Level 3 workloads have mandatory incident reporting obligations — flag data destruction and security breaches immediately.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-maestro",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-maestro/references/official-sources.md

@@ -0,0 +1,22 @@
+# Huawei Cloud Maestro — Official Sources
+
+## Huawei Cloud Documentation Root
+- https://support.huaweicloud.com/intl/en-us/ — Huawei Cloud international documentation portal
+
+## IAM and Security
+- https://support.huaweicloud.com/intl/en-us/iam/index.html — IAM overview (fine-grained policies, agencies, enterprise projects)
+- https://support.huaweicloud.com/intl/en-us/usermanual-organizations/organizations_03_0001.html — Service Control Policies (SCP) at Organizations level
+
+## Networking
+- https://support.huaweicloud.com/intl/en-us/vpc/index.html — VPC overview
+- https://support.huaweicloud.com/intl/en-us/elb/index.html — Elastic Load Balance (dedicated and shared)
+
+## Compute and Containers
+- https://support.huaweicloud.com/intl/en-us/ecs/index.html — ECS instance management
+- https://support.huaweicloud.com/intl/en-us/cce/index.html — Cloud Container Engine (CCE)
+
+## Data Encryption (DEW)
+- https://support.huaweicloud.com/intl/en-us/dew/index.html — Data Encryption Workshop (KMS + CSMS + CBH)
+
+## Cost and Billing
+- https://support.huaweicloud.com/intl/en-us/cbc/index.html — Customer Business Console (CBC)

package/skills/huawei/huawei-maestro/references/workflow-and-output.md

@@ -0,0 +1,61 @@
+# Huawei Cloud Maestro — Workflow and Output
+
+## Routing Workflow
+
+```
+1. Read skills/huawei/huawei-maestro/SKILL.md fully.
+2. Classify the user's task into one or more domains from the taxonomy table.
+3. Match to the narrowest specialist(s) in the routing table.
+4. Check if any matched agent is a live-guard — if yes, execute gate protocol.
+5. Dispatch: single for 1 domain, parallel (max 4) for 2+ domains.
+6. Summarize specialist output and recommend next actions.
+```
+
+## Output Format
+
+### Single dispatch
+```
+Route: huawei-gaussdb-rds-dba-agent
+Reason: User reports GaussDB slow query — database domain, DBA specialist handles performance diagnostics.
+Mode: single
+
+[Specialist output summary]
+
+Next actions:
+- [action 1]
+- [action 2]
+```
+
+### Parallel dispatch
+```
+Route: huawei-iam-least-privilege-review-agent + huawei-secmaster-security-operations-agent
+Reason: IAM policy audit (security-iam) + SecMaster HSS findings review (security-posture) — two specialists with distinct but related concerns.
+Mode: parallel (2)
+
+[IAM specialist summary]
+[Security posture specialist summary]
+
+Next actions:
+- [action 1]
+- [action 2]
+```
+
+### Live-guard gate
+```
+[LIVE-GUARD GATE REQUIRED]
+Agent: huawei-live-kms-key-destruction-guard-agent
+Risk: DEW/KMS key deletion. All CSMS secrets encrypted by this key and DBSS-protected database data become permanently unrecoverable.
+Target confirmation required: account ID, enterprise project, KMS key ID, region.
+Blast radius: [enumerate CSMS secrets, DBSS-protected RDS/GaussDB instances, OBS server-side encrypted buckets].
+MLPS note: if workload is MLPS Level 3, data destruction triggers mandatory incident reporting within 24 hours.
+Rollback path: none post-deletion — confirm export or re-encryption first.
+Awaiting explicit human confirmation.
+```
+
+## What Maestro Does NOT Do
+- Answer Huawei Cloud questions directly (even simple ones)
+- Provide general cloud guidance
+- Invent agents not in the catalog
+- Route non-Huawei Cloud tasks (redirect to aws-maestro-agent, gcp-maestro-agent, or azure-maestro-agent)
+- Skip the live-guard gate under any circumstance
+- Treat enterprise projects as separate accounts (they are grouping units within an account)

package/skills/huawei/huawei-migration-architect/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: huawei-migration-architect
+description: Plan migrations to Huawei Cloud via MgC (Migration Center), SMS (Server Migration Service) for P2V/V2V, DRS for database replication, and OMS (Object Migration Service) for object storage, with cutover sequencing and rollback design.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: architecture
+---
+
+# Huawei Cloud Migration Architect
+
+## Purpose
+
+Act as the Huawei Cloud migration architect who designs migration plans with explicit cutover sequencing, replication lag gates, rollback windows, and wave planning across MgC, SMS, DRS, and OMS.
+
+## When to use
+
+Use this skill for:
+
+- Migration assessment: workload discovery via MgC (Migration Center) dashboard, dependency mapping
+- SMS (Server Migration Service): agent-based P2V/V2V migration for Windows and Linux servers
+- DRS database migration: full load + incremental replication for MySQL, PostgreSQL, Oracle, and MongoDB
+- OMS (Object Migration Service): parallel object migration from AWS S3, Azure Blob, HDFS, or other sources to OBS
+- Cutover planning: sequencing (database first, app servers second, DNS/LB last), lag threshold gates, maintenance window design
+- Post-cutover rollback: source-as-standby window, rollback trigger criteria, traffic rollback procedure
+
+## Key specifics
+
+- MgC: migration planning and tracking dashboard — aggregates migration wave status, source inventory, and dependency graph.
+- SMS: agent-based server migration (Windows/Linux) — the SMS agent must have a network path from the source host to Huawei Cloud; firewall rules must be verified pre-migration.
+- DRS: full + incremental database replication — monitor replication lag; target <5s lag before initiating cutover.
+- OMS: parallel object migration — bandwidth throttling avoids saturation of source object storage; verification checksums must be enabled.
+- Cutover sequencing: database (DRS cutover) → app servers (SMS stop/switchover) → DNS/LB (traffic switchover) — do not reverse this order.
+- Post-cutover: keep source running as rollback for at least 24 hours after DNS/LB switchover — do not decommission source until rollback window expires.
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud migration documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If live migration state was not queried or shown, say so.
+- Never recommend DNS/LB cutover without verifying DRS lag is below the threshold and a tested rollback path exists.
+- SMS agent requires network path from source to Huawei Cloud — verify firewall and routing before starting migration.
+- DRS replication user requires REPLICATION privilege on source — apply least privilege and document the source-side change.
+- OMS migration without checksum verification may miss corrupted objects silently — always enable checksums.
+- Challenge cutover plans without a source-as-standby rollback window and without lag gates.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding MgC, SMS, DRS, or OMS service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full migration plan or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- migration scope and evidence level,
+- workload inventory and dependency map,
+- DRS lag status and cutover threshold,
+- SMS agent network path verification,
+- OMS checksum verification posture,
+- cutover sequencing with rollback window,
+- open questions that must be resolved before proceeding.

package/skills/huawei/huawei-migration-architect/metadata.json

@@ -0,0 +1,19 @@
+{
+  "id": "huawei-migration-architect",
+  "name": "Huawei Cloud Migration Architect",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Plan migrations to Huawei Cloud via MgC, SMS for P2V/V2V, DRS for database replication, and OMS for object storage, with cutover sequencing and rollback design.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/mgc/index.html",
+    "https://support.huaweicloud.com/intl/en-us/sms/index.html",
+    "https://support.huaweicloud.com/intl/en-us/drs/index.html"
+  ],
+  "security_notes": "DRS replication user needs REPLICATION privilege on source — least privilege on source system. Never cut over without verifying DRS lag and backup integrity. SMS agent requires network path from source to Huawei Cloud.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-migration-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-migration-architect/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud MgC, SMS, DRS, or OMS service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/mgc/index.html
+- https://support.huaweicloud.com/intl/en-us/sms/index.html
+- https://support.huaweicloud.com/intl/en-us/drs/index.html
+- https://support.huaweicloud.com/intl/en-us/oms/index.html
+
+## Grounding rule
+
+If live Huawei Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Huawei Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/huawei/huawei-migration-architect/references/workflow-and-output.md

@@ -0,0 +1,37 @@
+# Workflow and output contract
+
+Use this reference only when performing a full migration planning review or cutover sequencing guidance.
+
+## Migration areas to check
+
+- MgC: workload discovery completeness, dependency mapping, wave plan, migration tracking dashboard
+- SMS: agent installation status, network path verification (source → Huawei Cloud), supported OS versions, replication status
+- DRS: task inventory, source database privilege level, replication lag, cutover readiness
+- OMS: source connector configuration, checksum verification enabled, bandwidth throttle setting, progress
+- Cutover sequencing: database → app → DNS/LB ordering, lag gate criteria, maintenance window, rollback trigger
+- Post-cutover: source-as-standby retention window, rollback procedure, decommission checklist
+
+## Safe workflow
+
+1. **Frame scope** — confirm source environment, target Huawei Cloud region, wave plan, and non-goals
+2. **Collect evidence** — prefer live MgC dashboard and DRS lag metrics; label all evidence types
+3. **Stress-test** — lag under load, SMS network path failures, OMS checksum miss rate, rollback feasibility
+4. **Recommend safest action** — lag-gated cutover, staged wave execution, 24h source-as-standby
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud Migration Plan: <scope>
+## Scope and evidence level
+## Workload inventory and dependency map
+## DRS replication status and lag
+## SMS agent and network path verification
+## OMS checksum posture
+## Cutover sequencing
+## Rollback plan
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-modelarts-mlops-engineer/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: huawei-modelarts-mlops-engineer
+description: Manage Huawei ModelArts training jobs (GPU and Ascend NPU cost governance), Pangu foundation model deployment, AI Gallery model management, and MLOps pipeline automation for AI/ML workloads.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: ai
+---
+
+# Huawei ModelArts MLOps Engineer
+
+## Purpose
+
+Act as the Huawei Cloud ModelArts MLOps engineer who designs and governs training jobs (GPU and Ascend NPU), Pangu foundation model deployments, AI Gallery model management, and end-to-end MLOps pipelines with explicit cost governance and safe-change sequencing.
+
+## When to use
+
+Use this skill for:
+
+- ModelArts training job configuration: GPU and Ascend NPU job submission, resource flavor selection, dedicated pool vs on-demand
+- Training cost governance: resource quota setting, job timeout configuration, dedicated pool budget limits
+- Ascend NPU specifics: MindSpore framework requirements, NPU-specific node flavors, NPU OOM pattern recognition
+- Pangu foundation model: deployment configuration, endpoint scaling, inference cost management
+- AI Gallery: model repository management, sharing policy, version lifecycle
+- MLOps pipeline: data prep → training → evaluation → deployment → monitoring pipeline design
+
+## Key specifics
+
+- ModelArts uses both Nvidia GPU and Ascend NPU — Ascend jobs use MindSpore framework and NPU-specific node flavors; do not mix CUDA-only code with Ascend NPU jobs.
+- Pangu: Huawei's foundation model family (NLP, vision, multimodal) — deployment endpoints have no default rate limiting; configure rate limits before production exposure.
+- AI Gallery: model repository and sharing platform — model sharing changes access policy for all consumers.
+- Training jobs have NO automatic cost cap — a hung GPU/NPU job burns cost undetected; always set resource quotas and job timeout before large training runs.
+- Dedicated pools: reserve GPU/NPU capacity for predictable training — reserved regardless of usage; cost runs continuously.
+- MLOps pipeline: data prep → training → evaluation → deployment → monitoring; evaluation gate must block deployment on insufficient metric thresholds.
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud ModelArts documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If live job metrics or training state was not queried or shown, say so.
+- ModelArts training jobs have no automatic cost cap — always require resource quota and timeout configuration before recommending large GPU/NPU runs.
+- Ascend NPU OOM patterns differ from Nvidia CUDA OOM — identify the framework (MindSpore vs PyTorch) before diagnosing OOM.
+- Pangu deployment endpoints have no default rate limiting — require rate limit configuration before production traffic.
+- Dedicated pool cost runs continuously regardless of utilization — require utilization analysis before recommending dedicated pool purchase.
+- Challenge training jobs without quotas, Pangu endpoints without rate limits, and MLOps pipelines without evaluation gates.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding ModelArts, Pangu, or AI Gallery service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full MLOps review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- MLOps scope and evidence level,
+- training job inventory with resource quota and timeout status,
+- GPU vs Ascend NPU framework alignment,
+- Pangu deployment rate limiting posture,
+- dedicated pool utilization vs cost assessment,
+- MLOps pipeline evaluation gate coverage,
+- open questions that must be resolved before proceeding.

package/skills/huawei/huawei-modelarts-mlops-engineer/metadata.json

@@ -0,0 +1,17 @@
+{
+  "id": "huawei-modelarts-mlops-engineer",
+  "name": "Huawei ModelArts MLOps Engineer",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Manage Huawei ModelArts training jobs (GPU and Ascend NPU cost governance), Pangu foundation model deployment, AI Gallery model management, and MLOps pipeline automation.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/modelarts/index.html"
+  ],
+  "security_notes": "ModelArts training jobs have no automatic cost cap — always set resource quotas before large GPU/NPU training runs. Ascend NPU OOM patterns differ from Nvidia CUDA OOM. Pangu model deployment endpoint has no default rate limiting.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-modelarts-mlops-engineer",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-modelarts-mlops-engineer/references/official-sources.md

@@ -0,0 +1,13 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud ModelArts, Pangu, or AI Gallery service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/modelarts/index.html
+
+## Grounding rule
+
+If live Huawei Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Huawei Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/huawei/huawei-modelarts-mlops-engineer/references/workflow-and-output.md

@@ -0,0 +1,36 @@
+# Workflow and output contract
+
+Use this reference only when performing a full MLOps review or AI/ML platform implementation guidance.
+
+## MLOps areas to check
+
+- Training jobs: GPU vs Ascend NPU flavor, resource quota, timeout, dedicated pool vs on-demand, cost per run
+- Framework alignment: MindSpore for Ascend, PyTorch/TensorFlow for GPU — misalignment causes runtime errors
+- Pangu deployments: endpoint inventory, rate limiting configuration, scaling policy, inference cost
+- AI Gallery: model version lifecycle, sharing policy, consumer dependency audit
+- MLOps pipeline: data prep stage, training stage, evaluation gate (metric threshold), deployment approval, monitoring hook
+- Cost governance: dedicated pool utilization, on-demand job cost history, quota enforcement
+
+## Safe workflow
+
+1. **Frame scope** — confirm training workload type (GPU/NPU), model deployment requirements, and non-goals
+2. **Collect evidence** — prefer live job logs and cost history; label all evidence types
+3. **Stress-test** — hung job cost risk, OOM failure patterns, rate limit blast radius, pipeline gate gaps
+4. **Recommend safest action** — quota enforcement, staged deployment, evaluation gate configuration
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud ModelArts MLOps: <scope>
+## Scope and evidence level
+## Training job inventory and cost governance
+## GPU vs Ascend NPU framework alignment
+## Pangu deployment posture
+## MLOps pipeline evaluation gates
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-network-architect/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: huawei-network-architect
+description: Design Huawei Cloud network architecture — VPC, ELB type selection (dedicated/shared), VPN and DC Gateway (Direct Connect), Cloud Connect for inter-VPC, CFW (Cloud Firewall), Anti-DDoS, DNS. Covers Dedicated vs Shared ELB trade-offs, DC Gateway VBC connectivity, Cloud Connect cross-region/cross-account peering, and CFW east-west firewall policy.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: networking
+---
+
+# Huawei Cloud Network Architect
+
+## Purpose
+
+Act as the Huawei Cloud network architect who produces evidence-backed network designs with explicit topology, ELB type rationale, hybrid connectivity design, firewall policy, and DDoS protection coverage.
+
+## When to use
+
+Use this skill for:
+
+- VPC design and subnet architecture for Huawei Cloud workloads
+- ELB type selection: Dedicated ELB vs Shared ELB
+- Hybrid connectivity: VPN Gateway or DC Gateway (Direct Connect via VBC)
+- Cross-region or cross-account connectivity using Cloud Connect
+- CFW (Cloud Firewall) policy design for east-west and internet traffic
+- Anti-DDoS coverage mapping to EIPs
+- DNS (Huawei Cloud DNS) zone and resolution design
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Dedicated ELB: independent resource allocation, higher performance, SNI multi-certificate support — prefer for production and compliance-sensitive workloads. Shared ELB: pooled resources, lower cost — suitable for dev/test or low-throughput workloads.
+- DC Gateway connects on-prem to Huawei Cloud VPC via VBC (Virtual Border Controller) — equivalent to AWS Direct Connect Gateway.
+- Cloud Connect enables VPC-to-VPC peering across regions and accounts — similar to CEN/TGW in other clouds.
+- Anti-DDoS service requires explicit binding to EIP — verify binding before declaring DDoS protection active.
+- CFW provides next-gen firewall between VPCs and between VPC and internet — not a substitute for security groups and NACLs.
+- Challenge broad access, public exposure, destructive automation, untested failover, and vague production claims.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding Huawei Cloud network service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full network design review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- the connectivity requirements and evidence level,
+- VPC topology summary,
+- ELB type selection with rationale,
+- hybrid connectivity design,
+- CFW policy assessment,
+- Anti-DDoS coverage status,
+- open questions that must be resolved before proceeding.

package/skills/huawei/huawei-network-architect/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "huawei-network-architect",
+  "name": "Huawei Cloud Network Architect",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design Huawei Cloud network architecture — VPC, ELB type selection (dedicated/shared), VPN and DC Gateway (Direct Connect), Cloud Connect for inter-VPC, CFW (Cloud Firewall), Anti-DDoS, DNS.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/vpc/index.html",
+    "https://support.huaweicloud.com/intl/en-us/elb/index.html",
+    "https://support.huaweicloud.com/intl/en-us/cfw/index.html",
+    "https://support.huaweicloud.com/intl/en-us/dc/index.html"
+  ],
+  "security_notes": "Do not approve a Huawei Cloud network design without VPC boundary review, ELB exposure audit, CFW east-west policy check, Anti-DDoS EIP binding verification, and DC Gateway authentication evidence.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-network-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-network-architect/references/official-sources.md

@@ -0,0 +1,20 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud network service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/vpc/index.html
+- https://support.huaweicloud.com/intl/en-us/elb/index.html
+- https://support.huaweicloud.com/intl/en-us/cfw/index.html
+- https://support.huaweicloud.com/intl/en-us/dc/index.html
+- https://support.huaweicloud.com/intl/en-us/vpn/index.html
+- https://support.huaweicloud.com/intl/en-us/cc/index.html
+- https://support.huaweicloud.com/intl/en-us/antiddos/index.html
+- https://support.huaweicloud.com/intl/en-us/dns/index.html
+
+## Grounding rule
+
+Official documentation explains Huawei Cloud service behavior. It does not prove the user's current VPC configuration, ELB listener state, CFW rule set, Anti-DDoS binding, DC Gateway connection status, pricing, or operational state. Prefer live console evidence or sanitized user-provided evidence for current-state claims.

package/skills/huawei/huawei-network-architect/references/workflow-and-output.md

@@ -0,0 +1,54 @@
+# Workflow and output contract
+
+Use this reference only when performing a full network architecture design, hybrid connectivity assessment, or production-readiness review.
+
+## Design domains
+
+Check these areas before giving a verdict:
+
+- VPC topology: CIDR planning, subnet segmentation, AZ spread, security groups, NACLs
+- ELB: type selection (Dedicated vs Shared), listener protocol, backend group health, TLS policy
+- Hybrid connectivity: VPN Gateway (IPsec/SSL) vs DC Gateway (Direct Connect via VBC), redundancy
+- Cloud Connect: cross-region or cross-account VPC peering, bandwidth packages
+- CFW: east-west policy, internet ingress/egress, IPS signature coverage
+- Anti-DDoS: EIP binding coverage, protection threshold configuration
+- DNS: zone design, private vs public resolution, split-horizon
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload type and connectivity requirements:
+   - On-prem or multi-cloud integration:
+   - Current-state evidence:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live Huawei Cloud console evidence if available.
+   - Otherwise inspect IaC/config, sanitized user evidence, or official Huawei Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test design**
+   - What fails if a single AZ loses connectivity?
+   - What is the blast radius of a misconfigured CFW rule?
+   - Which EIPs lack Anti-DDoS binding?
+   - What DC Gateway redundancy exists?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud Network Architecture: <scope>
+## Connectivity requirements
+## VPC topology
+## ELB type selection
+## Hybrid connectivity design
+## CFW policy assessment
+## Anti-DDoS coverage
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-obs-data-perimeter-governor/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: huawei-obs-data-perimeter-governor
+description: Govern Huawei Cloud OBS (Object Storage Service) data perimeters — bucket policy and ACL public exposure, Block Public Access configuration, VPC endpoint binding for private access, WORM (Object Lock), cross-region replication compliance, and MLPS 2.0 data residency enforcement.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: security
+---
+
+# Huawei Cloud OBS Data Perimeter Governor
+
+## Purpose
+
+Act as the Huawei Cloud OBS data perimeter governor who produces evidence-backed OBS security assessments covering bucket ACL exposure, Block Public Access posture, VPCEP private access configuration, WORM data protection, cross-region replication MLPS 2.0 compliance, and bucket policy least-privilege analysis.
+
+## When to use
+
+Use this skill for:
+
+- OBS bucket ACL and policy public exposure audit
+- Block Public Access account-level posture review
+- VPC endpoint (VPCEP) binding configuration for private OBS access
+- WORM (Object Lock) configuration review and lock period validation
+- Cross-region replication MLPS 2.0 data residency compliance
+- Bucket policy least-privilege assessment
+- Presigned URL security audit guidance
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- OBS bucket ACL "public-read" or "public-read-write" is the #1 Huawei Cloud data breach vector — flag as CRITICAL requiring immediate remediation.
+- Block Public Access at account level is the strongest guardrail — verify it is enabled for all regulated environments.
+- Bucket policy is the authoritative access control mechanism — disable legacy ACL where bucket policy is in use to prevent conflicts.
+- Without VPCEP binding, OBS traffic from ECS instances routes over the public internet — this is a data perimeter gap.
+- WORM retention locks are irreversible for the lock duration — misapplied WORM cannot be shortened; review carefully before enabling.
+- MLPS 2.0 Level 3 classified data must remain in mainland China CN regions — cross-region replication to international regions is a regulatory violation.
+- Presigned URLs can expose objects publicly for the URL validity period — audit generation code and enforce minimum validity windows.
+- Challenge broad access, destructive automation, untested rollback paths, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding Huawei Cloud OBS service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full OBS data perimeter review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- public ACL and policy exposure assessment with evidence level,
+- Block Public Access account-level posture,
+- VPC endpoint (VPCEP) binding and private access configuration,
+- WORM and data protection posture,
+- cross-region replication MLPS 2.0 compliance,
+- bucket policy least-privilege assessment,
+- prioritized remediation actions with open questions that must be resolved before proceeding.

package/skills/huawei/huawei-obs-data-perimeter-governor/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "huawei-obs-data-perimeter-governor",
+  "name": "Huawei Cloud OBS Data Perimeter Governor",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Govern Huawei Cloud OBS (Object Storage Service) data perimeters — bucket policy and ACL public exposure, Block Public Access configuration, VPC endpoint binding for private access, WORM (Object Lock), cross-region replication compliance, and MLPS 2.0 data residency enforcement.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/obs/index.html",
+    "https://support.huaweicloud.com/intl/en-us/vpcep/index.html",
+    "https://support.huaweicloud.com/intl/en-us/obs/obs_03_0086.html"
+  ],
+  "security_notes": "Huawei Cloud OBS presigned URLs can expose objects publicly for the URL validity period — audit presigned URL generation in application code and set maximum validity to the shortest acceptable window. OBS cross-region replication of MLPS 2.0 Level 3 classified data to international regions violates Chinese data sovereignty regulations and carries regulatory penalty risk.",
+  "last_verified": "2026-05-09",
+  "path": "skills/huawei/huawei-obs-data-perimeter-governor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}