huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/SKILL.md

@@ -0,0 +1,190 @@
+---
+name: huawei-cloud-find-skills
+description: |
+  Invoke this skill to search, discover, browse, find and install any Huawei Cloud (华为云) agent skill.Triggers include: "华为云","华为云有什么skill","华为云相关skill","华为云agent skill 市场","华为云skill类目","explore Huawei Cloud skills","show Huawei Cloud skill categories","does a Huawei Cloud skill exist for...","which Huawei Cloud skills exist","搜索华为云技能","有没有管理ECS/OBS/RDS的skill","帮我找 XX 华为云skill","介绍 XX Skill 内容","华为云 XX Skill 具体做什么","安装华为云Skill".
+---
+
+> [!IMPORTANT]
+> **For any Huawei Cloud query or management task:**
+> 1. **Search** — use this skill (`huawei-cloud-find-skills`) to find the relevant Skill.
+> 2. **Install** — install the matched Skill (see [Step 3](#step-3-install-skill)).
+> 3. **Execute** — follow the installed Skill's instructions to fulfill the request.
+
+# Huawei Cloud Agent Skills Search and Discovery
+
+This skill enables users to efficiently search, discover, and install Huawei Cloud skills. 
+
+## Scenario Description
+
+This skill enables users to:
+
+- **Search Skills**: Find skills by keyword, category, or both (matched against name, description, and triggers)
+- **Browse Categories**: Explore available skill categories
+- **View Skill Details**: Fetch full SKILL.md content from GitHub for specific skills
+- **Install Skills**: Guide users through skill installation via `npx skills add` (GitCode default), `npx clawhub install`, or fallback GitHub method
+
+**Architecture**: GitCode API v5 (`index.json` + `cn-en-map.json`) → HTTP GET (base64 decode) → In-memory search → GitHub raw fetch for details → Install
+
+### Use Cases
+
+- "Find a skill for managing ECS instances"
+- "What Huawei Cloud skills are available for OBS?"
+- "华为云有哪些 VPC 相关的 skill?"
+- "Browse all available Huawei Cloud skills"
+- "Install a skill for RDS management"
+- "帮我找一个华为云网络相关的skill"
+
+## Prerequisites
+
+- **Node.js >= 20** must be installed
+- **Network access** to `gitcode.com` (API v5 for index) and `github.com` / `raw.githubusercontent.com` (for skill details)
+
+### Step 0: Check Python Environment
+
+> **MANDATORY**: Before running any script command, verify Python is available.
+
+```bash
+# Check Python availability
+python --version   # or: python3 --version
+```
+
+If the command fails or returns Python 2.x:
+
+1. **Install Python 3**: Download from [python.org](https://www.python.org/downloads/) or use a package manager:
+   ```bash
+   # macOS
+   brew install python3
+   # Ubuntu/Debian
+   sudo apt-get install python3
+   # Windows — download installer from python.org, check "Add Python to PATH"
+   ```
+2. **Verify after install**: Run `python --version` again to confirm Python 3.6+ is available
+3. **If `python` points to Python 2**: Use `python3` instead of `python` in all commands below
+
+## Repository Info
+
+```
+INDEX_REPO=2501_91318609/skills-for-index
+INDEX_BRANCH=main
+SKILLS_REPO=huaweicloud/huaweicloud-skills
+SKILLS_BRANCH=master
+RAW_BASE=https://raw.githubusercontent.com/$SKILLS_REPO/$SKILLS_BRANCH
+```
+
+## Index Source
+
+The search script fetches the skill index from GitCode API v5 via HTTP GET (base64 auto-decoded):
+
+```
+SKILLS_INDEX_URL=https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main
+SKILLS_CN_EN_MAP_URL=https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main
+```
+
+
+## Core Workflow
+
+### Step 1: Search Skills
+
+> **MANDATORY**: The agent MUST execute the search script to search the skill index. Do NOT read the JSON file directly — always use the script.
+
+Given `keyword` (from AI-understood user intent) and optional `category`, run the search script:
+
+```bash
+node scripts/search-skills.mjs <keyword>
+node scripts/search-skills.mjs <keyword> -c <category>
+node scripts/search-skills.mjs -c <category>
+```
+
+→ [scripts/search-skills.mjs](scripts/search-skills.mjs) (Node.js — cross-platform)
+
+**What the script does**:
+1. Fetches `index.json` and `cn-en-map.json` via HTTP GET from GitCode API v5 (auto-decodes base64 content)
+2. Expands keywords via `cn-en-map.json` (bidirectional CN↔EN, e.g., "ECS" → "ECS, 弹性云服务器, 云服务器")
+3. Scores each skill: name match **+10**, trigger match **+8**, description match **+5**, service match **+3**
+4. Sorts by score descending, outputs formatted results with matched keywords
+
+**Fallback iteration** (if no results): 1) Switch CN↔EN keywords 2) Expand keywords 3) Remove category filter 4) Try synonyms 5) List all skills
+
+The process should persist until the skill is found or its absence is confirmed. In the event of total failure, notify the user of the specific steps that were attempted.
+
+### Step 2: View Skill Details (optional)
+
+Fetch the full SKILL.md content from GitHub for intent validation. Skip this step if the search results from Step 1 are sufficiently informative.
+
+```bash
+# URL pattern — use the skill's category, service, and name from index
+DETAIL_URL="https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills/${category}/${service}/${name}/SKILL.md"
+```
+
+The agent can fetch this URL using `curl` or its web-fetch tool, then present the skill's full documentation to the user.
+
+### Step 3: Install Skill
+
+> **MANDATORY**: Use one of the commands below. Option A is the default; Option C is a fallback when Option A is unavailable.
+
+```bash
+# Option A: npx skills add from GitCode (default)
+npx skills add https://gitcode.com/huaweicloud/huaweicloud-skills.git#master --skill <skill-name> -y
+
+# Option B: npx clawhub install (OpenClaw ecosystem)
+npx clawhub install <skill-name> -y
+
+# Option C (fallback): npx skills add from GitHub
+npx skills add huaweicloud/huaweicloud-skills --skill <skill-name> -y
+```
+
+If all installation attempts fail, report the error message to the user. Do NOT attempt any method outside the commands above.
+
+## Parameters
+
+| Parameter | Required/Optional | Description | Default |
+|-----------|-------------------|-------------|---------|
+| `Keyword` | Optional | Search keyword (matched against name, description, triggers, service) | None |
+| `Category` | Optional | Category code for filtering (e.g., "computing", "storage", "network") | None |
+| `skill-name` | Required (Step 3) | Exact skill name for installing | None |
+
+
+## Reference Documentation
+
+| Document | Description |
+|----------|-------------|
+| GitCode API v5 `index.json` | Skill index fetched via HTTP GET (base64 decoded) |
+| GitCode API v5 `cn-en-map.json` | Chinese-English keyword mapping fetched via HTTP GET (base64 decoded) |
+| [scripts/search-skills.py](scripts/search-skills.py) | Search script (Python) — fetches from GitCode API v5, expands keywords, scores, sorts |
+
+## Search Heuristics
+
+> Optional reference for keyword-to-category hints. The agent can infer categories from `index.json` without these.
+
+- Cloud infrastructure keywords (ecs, bms, vpc, obs, rds, ...) → likely `computing`, `network`, `storage`, etc.
+- Tool keywords (cli, terraform, koo) → likely `devtools`
+- Management keywords (monitoring, alarm, log) → likely `monitoring`
+
+## Troubleshooting
+
+### Issue: Script fails with "Failed to fetch index.json"
+
+**Cause**: GitCode API v5 URL unreachable
+**Solution**: Verify network connectivity to `gitcode.com`
+
+### Issue: GitCode API v5 returns 404
+
+**Cause**: File path incorrect or default branch is not `main`
+**Solution**: Verify the skill's `category`, `service`, and `name` from search results
+
+### Issue: Search returns no results
+
+**Cause**: Keywords don't match any skill
+**Solution**:
+1. Try broader keywords
+2. Switch between Chinese and English keywords (e.g., "对象存储" → "obs")
+3. List all skills: `python scripts/search-skills.py -c "computing"`
+
+## Notes
+
+- This skill is **read-only** and does not create any cloud resources
+- **No cache management needed** — index is fetched fresh from GitCode API v5 each run
+- **Network required** — index data is hosted on GitCode, fetched via HTTP GET (base64 decoded)
+- **MUST use script to search** — do not read index.json directly
+- Index repo: `https://gitcode.com/2501_91318609/skills-for-index` (branch: `main`)
+- Skills repo: `https://github.com/huaweicloud/huaweicloud-skills` (branch: `master`)

package/plugins/huaweicloud-core/skills/huawei-cloud-find-skills/scripts/search-skills.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+import { Buffer } from 'node:buffer';
+
+const INDEX_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main';
+const CN_EN_MAP_URL = 'https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/cn-en-map.json?ref=main';
+
+const GENERIC_KEYWORDS = new Set([
+  '华为云', 'huawei', 'huawei cloud', '云', 'cloud', '技能', 'skill', 'skills',
+  '所有', 'all', '全部', '有什么', '有哪些', '相关', '列表', 'list',
+  '查找', '搜索', '发现', '浏览', 'find', 'search', 'discover', 'browse',
+  'show', 'explore', 'agent', '市场', 'market', '类目', 'category', '安装', 'install',
+]);
+
+async function fetchJson(url, label) {
+  const resp = await fetch(url, { headers: { 'User-Agent': 'huaweicloud-devkit/1.0' } });
+  const data = await resp.json();
+  if (data?.encoding === 'base64' && data.content) {
+    return JSON.parse(Buffer.from(data.content, 'base64').toString('utf8'));
+  }
+  return data;
+}
+
+function isGeneric(kw) {
+  const k = kw.toLowerCase().trim();
+  return GENERIC_KEYWORDS.has(k) || /华为云|huawei/i.test(k);
+}
+
+function expandKeywords(raw, cnEnMap) {
+  if (!raw) return [[], []];
+  const parts = raw.replace(/[,;]/g, ' ').split(/\s+/).filter(Boolean);
+  const expanded = [...parts];
+  for (const p of parts) {
+    const lower = p.toLowerCase();
+    if (cnEnMap[p]) expanded.push(cnEnMap[p]);
+    for (const [cn, en] of Object.entries(cnEnMap)) {
+      if (en === lower) expanded.push(cn);
+    }
+  }
+  const unique = [...new Set(expanded)].sort();
+  return [unique.filter((kw) => !isGeneric(kw)), unique.filter((kw) => isGeneric(kw))];
+}
+
+function scoreSkill(skill, specificKws, genericKws) {
+  if (!specificKws.length && !genericKws.length) return [1, []];
+  let total = 0;
+  const matched = [];
+  const nl = (skill.name || '').toLowerCase();
+  const dl = (skill.description || '').toLowerCase();
+  const sl = (skill.service || '').toLowerCase();
+  const tl = (skill.triggers || []).map((t) => (t || '').toLowerCase());
+
+  for (const kw of specificKws) {
+    const k = kw.toLowerCase();
+    let s = 0;
+    if (nl.includes(k)) s += 10;
+    else if (tl.some((t) => t.includes(k))) s += 8;
+    else if (dl.includes(k)) s += 5;
+    else if (sl.includes(k)) s += 3;
+    if (s > 0) { total += s; matched.push(kw); }
+  }
+  for (const kw of genericKws) {
+    const k = kw.toLowerCase();
+    let s = 0;
+    if (nl.includes(k)) s += 10;
+    else if (tl.some((t) => t.includes(k))) s += 4;
+    else if (dl.includes(k)) s += 2;
+    else if (sl.includes(k)) s += 1;
+    if (s > 0) { total += s; matched.push(kw); }
+  }
+  if (!specificKws.length && total === 0) {
+    total = 1;
+    if (dl.length > 20) total += 1;
+    if (tl.length) total += 1;
+  }
+  return [total, matched];
+}
+
+async function main() {
+  const keyword = process.argv.slice(2).filter((a) => !a.startsWith('-')).join(' ') || '';
+  const catIdx = process.argv.indexOf('-c');
+  const category = catIdx >= 0 ? process.argv[catIdx + 1] || '' : '';
+
+  try {
+    const [idx, cnEnMap] = await Promise.all([
+      fetchJson(INDEX_URL, 'index'),
+      fetchJson(CN_EN_MAP_URL, 'cn-en-map'),
+    ]);
+
+    if (!keyword && !category) {
+      console.log(`Categories: ${(idx.categories || []).join(', ')}`);
+      console.log('Usage: node search-skills.mjs <keyword> [-c <category>]');
+      return;
+    }
+
+    const [specificKws, genericKws] = expandKeywords(keyword, cnEnMap);
+    const hasSpecific = specificKws.length > 0;
+
+    const results = [];
+    for (const skill of idx.skills || []) {
+      if (category && skill.category !== category) continue;
+      const [score, matched] = scoreSkill(skill, specificKws, genericKws);
+      if (hasSpecific && score === 0) continue;
+      const desc = (skill.description || '').slice(0, 150);
+      results.push({ score, name: skill.name, category: skill.category, service: skill.service, description: desc + (skill.description?.length > 150 ? '...' : ''), triggers: (skill.triggers || []).slice(0, 5), matched });
+    }
+    results.sort((a, b) => b.score - a.score);
+
+    if (!results.length) {
+      console.log(`No results. Try broader keywords, remove category filter, or switch CN↔EN.`);
+      return;
+    }
+
+    console.log(`Found ${results.length} skill(s):`);
+    for (const r of results) {
+      console.log(`  [${r.score}pts] ${r.name} (${r.category}/${r.service})${r.matched.length ? ' matched: ' + r.matched.join(',') : ''}`);
+      console.log(`    ${r.description}`);
+    }
+  } catch (e) {
+    console.error(`Error: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: huawei-cts
+description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
+version: 1
+---
+
+# Huawei Cloud CTS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CTS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications, and resource tags.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Tracker required for traces | Must create a tracker before traces are recorded |
+| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
+| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
+| Organization tracker | Cross-account auditing requires organization tracker |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
+| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
+| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
+| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
+| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
+| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
+| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
+| List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| No traces found | Check tracker is created and enabled. Filter by time range |
+| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
+
+## Security
+
+- SHOULD enable CTS for all production accounts
+- MUST use OBS server-side encryption for trace logs
+
+## Cross-Skill References
+
+- **OBS**: See `huawei-obs` for tracker log delivery bucket

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: huawei-dds-dcs
+description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
+version: 1
+---
+
+# Huawei Cloud DDS / DCS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` before constructing commands.
+
+## DDS (Document Database Service — MongoDB Compatible)
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Requires 3-node replica | Minimum production deployment needs 3 nodes |
+| Shard key permanent | Once selected, shard key cannot be changed |
+| Storage auto-scaling off | Enable before storage fills |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
+| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
+| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## DCS (Distributed Cache Service — Redis/Memcached)
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Redis password required | Cannot create Redis instance without password |
+| Memcached no password | Memcached has no auth — only accessible within VPC |
+| Cache persistence costs | AOF/RDB persistence uses additional storage |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
+| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
+| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
+| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
+| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
+| DCS auto-expire not working | Enable auto-expire scan task for Redis |
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for instance networking
+- **Backup/CBR**: See `huawei-cbr` for backup management

package/plugins/huaweicloud-core/skills/huawei-deployment/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: huawei-deployment
+description: "Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry."
+version: 1
+---
+
+# Huawei Cloud CloudDeploy
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud CloudDeploy. Covers application creation, deployment task management, pipeline execution, and artifact configuration.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Service name may be `CodeArtsDeploy` | hcloud service name for deployment may be `CodeArtsDeploy` instead of `CloudDeploy`. Run `hcloud --help` to verify |
+| Deployment hosts need agent | Install CloudDeploy agent on target hosts first |
+| Task must reference application first | Create application before task |
+| Artifact source defaults to OBS | Most deployment tasks pull artifacts from OBS. Ensure bucket and object exist |
+| Parallel deployments may conflict | Lock resources or use deployment groups |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| Create application | `CreateApp --name=<n> --platform=<p> --cli-region=<r>` |
+| Create deployment task | `CreateTask --name=<n> --app_id=<id> --artifact_source_type=OBS` |
+| Start deployment | `StartTask --task_id=<id>` |
+| List tasks | `ListTasks --app_id=<id>` |
+| Delete task | `DeleteTask --task_id=<id>` |
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Agent offline | Check agent service on target host, network connectivity, firewall rules |
+| Deployment timeout | Check artifact size, increase task timeout, verify target host resources |
+| Artifact not found | Verify OBS bucket and object path, check artifact permissions |
+| Permission denied | Verify IAM roles for deployment: `CodeArtsDeploy FullAccess` or custom policy |
+
+## Security
+
+- MUST use IAM roles for deployment permissions
+- MUST verify artifact integrity before deployment
+- MUST not store credentials in deployment scripts
+
+## Cross-Skill References
+
+- **OBS artifact storage**: See `huawei-obs`
+- **ECS deployment target**: See `huawei-ecs`
+- **IAM permissions**: See `huawei-iam`

package/plugins/huaweicloud-core/skills/huawei-dew/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: huawei-dew
+description: "Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secrets, KMS for encryption keys, and credential rotation. Triggers on: secret, credential, API key, token, password, encrypt, decrypt, KMS, CSMS, DEW, certificate, CSR, rotation. Activates for ANY task involving secrets or credentials — load this skill first before touching secrets."
+version: 1
+---
+
+# Huawei Cloud DEW (Data Encryption Workshop)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Data Encryption Workshop (DEW). Covers CSMS for secret lifecycle management, KMS for encryption key management, credential rotation, and secure application integration patterns.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| NEVER fetch secret values into agent context | Use {{resolve:csms:secret-id:SecretString:key}} runtime injection |
+| NEVER echo credentials in conversation | AK/SK, passwords, tokens must never appear in chat |
+| KMS key deletion is irreversible | 7-30 day pending deletion window. Once gone, data is unrecoverable |
+| Secret rotation requires automation | Manual rotation risks stale credentials |
+| Cross-account KMS needs grants | KMS keys are regional. Cross-region data needs grant setup |
+
+## CSMS Operations
+
+### Read-only (safe — metadata only)
+| Operation | Description |
+|-----------|-------------|
+| ListSecrets | List all secrets (names only, no values) |
+| DescribeSecret | Get secret metadata (rotation config, KMS key, status) |
+| ListSecretVersions | List version IDs and stages (no values) |
+
+### Secret Value (blocked by policy — use runtime injection)
+| Operation | Safe Alternative |
+|-----------|-----------------|
+| DownloadSecret | Use {{resolve:csms:secret-id}} in IaC or SDK |
+| ShowSecretVersion | Use runtime injection, never in agent context |
+| GetSecretValue | Blocked. Use MCP proxy resolve pattern |
+
+## KMS Operations
+
+| Task | Command | Notes |
+|------|---------|-------|
+| List keys | hcloud KMS ListKeys | Read-only |
+| Create key | hcloud KMS CreateKey --key_alias=<name> | Requires write approval |
+| Encrypt | hcloud KMS EncryptData --key_id=<id> --plaintext=<b64> | Prefer SDK offline encrypt |
+| Decrypt | hcloud KMS DecryptData (**BLOCKED**) | Use runtime injection |
+
+## Runtime Injection Pattern
+
+`ash
+# Terraform / IaC
+resource "huaweicloud_csms_secret" "db_password" {
+  secret_string = var.db_password  # NEVER hardcode
+}
+
+# SDK
+secret_value = client.get_secret(secret_id="my-secret")
+# Use immediately, never print or store in context
+
+# hcloud (for approved automation only)
+hcloud CSMS DownloadSecret --secret_name=<name>
+# WARNING: Output goes to stdout. Pipe directly, never capture in agent.
+`
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Secret not found | Wrong region or project -> Verify secret ARN includes region/project |
+| AccessDenied on CSMS | Missing IAM CSMS policy -> Add csms:DescribeSecret + kms:Decrypt |
+| KMS key disabled | Key scheduled for deletion or manually disabled -> Enable or create new key |
+| Rotation stuck | Lambda/Python function error -> Check rotation function logs |
+
+## Security Considerations
+
+- MUST use runtime injection. NEVER fetch secrets into agent context
+- MUST rotate credentials every 90 days
+- MUST enable automatic rotation for CSMS secrets
+- MUST audit KMS key usage via CTS
+- SHOULD use customer-managed keys (CMK) for sensitive data
+- MUST NOT use default KMS keys for production workloads
+
+## MCP Tools
+
+- huaweicloud_list_operations service=DEW or CSMS or KMS
+- huaweicloud_run_readonly_command for ListSecrets/ListKeys (metadata only)
+- huaweicloud_safety policy blocks all secret value reads
+
+## References
+
+- DEW Docs: https://support.huaweicloud.com/dew/
+- CSMS usage: references/csms-usage.md
+- KMS usage: references/kms-usage.md

package/plugins/huaweicloud-core/skills/huawei-dew/references/csms-usage.md

@@ -0,0 +1,29 @@
+# CSMS Usage Guide
+
+## Create Secret
+hcloud CSMS CreateSecret --secret_name=prod-db-password --secret_string='{"password":"CHANGE_ME"}'
+
+## List Secrets (metadata only)
+hcloud CSMS ListSecrets
+
+## Describe Secret
+hcloud CSMS DescribeSecret --secret_name=prod-db-password
+
+## List Versions
+hcloud CSMS ListSecretVersions --secret_name=prod-db-password
+
+## Runtime Injection (Terraform)
+data "huaweicloud_csms_secret" "db" {
+  secret_name = "prod-db-password"
+}
+Use: data.huaweicloud_csms_secret.db.secret_string
+
+## Rotation
+- Enable auto-rotation: hcloud CSMS EnableSecretRotation --secret_name=<name> --rotation_interval=30
+- Rotation function ARN: provide Lambda to generate new secret value
+
+## Policy Rules
+- hcloud CSMS DownloadSecret -> BLOCKED (use runtime injection)
+- hcloud CSMS ShowSecretVersion -> BLOCKED
+- hcloud CSMS ListSecrets -> ALLOWED (metadata only)
+- hcloud CSMS DescribeSecret -> ALLOWED (metadata only)

package/plugins/huaweicloud-core/skills/huawei-dew/references/kms-usage.md

@@ -0,0 +1,23 @@
+# KMS Usage Guide
+
+## Create Key
+hcloud KMS CreateKey --key_alias=app-encryption-key --key_description="Application data encryption"
+
+## List Keys (metadata only)
+hcloud KMS ListKeys
+
+## Encrypt (offline preferred)
+hcloud KMS EncryptData --key_id=<key-id> --plaintext=<base64-data>
+
+## Decrypt (BLOCKED - use runtime)
+DO NOT use hcloud KMS DecryptData directly.
+Use SDK with KMS client in application runtime.
+
+## Key Rotation
+- Enable: hcloud KMS EnableKeyRotation --key_id=<key-id>
+- Rotation period: 365 days (default)
+
+## Key Deletion
+- Schedule: hcloud KMS ScheduleKeyDeletion --key_id=<key-id> --pending_days=7
+- Cancel during pending window: hcloud KMS CancelKeyDeletion --key_id=<key-id>
+- WARNING: After deletion window passes, data encrypted with this key is UNRECOVERABLE