huaweicloud-devkit 0.1.21 → 0.1.25-dev.0

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md

@@ -1,78 +1,78 @@
----
-name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
-version: 1
----
-
-# Huawei Cloud VPC
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
-
-## Common Workflows
-
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction |
-
-## Security Considerations
-
-- MUST use security groups, NOT iptables
-- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
-- SHOULD use network ACLs as defense-in-depth
-- SHOULD place databases in private subnets (no EIP)
-- MUST enable VPC flow logs for audit
-
-## MCP Tools
-
-- huaweicloud_list_operations service=VPC
-- huaweicloud_run_readonly_command for VPC/subnet discovery
-- huaweicloud_run_approved_command for writes
-
-## References
-
-- VPC Docs: https://support.huaweicloud.com/vpc/
-- Subnet guide: references/subnet.md
-- Security group: references/security-group.md
+---
+name: huawei-vpc
+description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
+version: 1
+---
+
+# Huawei Cloud VPC
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
+| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
+| Network ACL stateless | ACL rules must allow both inbound AND outbound |
+| EIP bills when idle | Unbound EIP still charges. Release when unused |
+| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
+| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
+| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
+| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. See `--help` for region-specific DNS IPs |
+
+## Common Workflows
+
+| Task | Command | Steps |
+|------|---------|-------|
+| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
+| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see `hcloud VPC CreateSubnet --help` |
+| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
+| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
+| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
+| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
+| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
+| List EIPs | hcloud EIP ListPublicips | |
+| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
+| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
+| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
+| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
+| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
+| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
+| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
+| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction |
+
+## Security Considerations
+
+- MUST use security groups, NOT iptables
+- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
+- SHOULD use network ACLs as defense-in-depth
+- SHOULD place databases in private subnets (no EIP)
+- MUST enable VPC flow logs for audit
+
+## MCP Tools
+
+- huaweicloud_list_operations service=VPC
+- huaweicloud_run_readonly_command for VPC/subnet discovery
+- huaweicloud_run_approved_command for writes
+
+## References
+
+- VPC Docs: https://support.huaweicloud.com/vpc/
+- Subnet guide: references/subnet.md
+- Security group: references/security-group.md

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -1,76 +1,76 @@
-# VPC Network Management Reference
-
-## DNS Addresses by Region
-
-Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
-
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
-| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
-
-**Subnet create with DNS**:
-```bash
-hcloud VPC CreateSubnet \
-  --subnet.name=<name> \
-  --subnet.vpc_id=<id> \
-  --subnet.cidr=10.50.1.0/24 \
-  --subnet.gateway_ip=10.50.1.1 \
-  --subnet.availability_zone=<az> \
-  --subnet.dnsList.1=100.125.1.250 \
-  --subnet.dnsList.2=100.125.129.250
-```
-
-## Nested Prefix Summary
-
-KooCLI 7.x VPC API requires nested prefixes:
-
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
-
-## EIP Management
-
-```bash
-# Create EIP (pay-per-use)
-hcloud EIP CreatePublicip --publicip.type=<type> \
-  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
-
-# Bind to ECS (PORT type, not ECS)
-hcloud EIP AssociatePublicips --publicip_id=<id> \
-  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
-
-# Unbind
-hcloud EIP DisassociatePublicip --publicip_id=<id>
-
-# List
-hcloud EIP ListPublicips
-
-# Delete (unbind first)
-hcloud EIP DeletePublicip --publicip_id=<id>
-```
-
-> EIP bills even when not bound. Release unused EIPs.
-
-## Security Group Quick Reference
-
-```bash
-# Create SG (no vpc_id needed)
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-
-# Add SSH rule
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-
-> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.
+# VPC Network Management Reference
+
+## DNS Addresses by Region
+
+Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
+
+| Region | Primary DNS | Secondary DNS |
+|--------|------------|---------------|
+| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
+| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
+
+**Subnet create with DNS**:
+```bash
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<id> \
+  --subnet.cidr=10.50.1.0/24 \
+  --subnet.gateway_ip=10.50.1.1 \
+  --subnet.availability_zone=<az> \
+  --subnet.dnsList.1=100.125.1.250 \
+  --subnet.dnsList.2=100.125.129.250
+```
+
+## Nested Prefix Summary
+
+KooCLI 7.x VPC API requires nested prefixes:
+
+| Resource | Create Param Prefix | Example |
+|----------|---------------------|---------|
+| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
+| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.` | `--security_group.name=sg-web` |
+| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+
+## EIP Management
+
+```bash
+# Create EIP (pay-per-use)
+hcloud EIP CreatePublicip --publicip.type=<type> \
+  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
+
+# Bind to ECS (PORT type, not ECS)
+hcloud EIP AssociatePublicips --publicip_id=<id> \
+  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+
+# Unbind
+hcloud EIP DisassociatePublicip --publicip_id=<id>
+
+# List
+hcloud EIP ListPublicips
+
+# Delete (unbind first)
+hcloud EIP DeletePublicip --publicip_id=<id>
+```
+
+> EIP bills even when not bound. Release unused EIPs.
+
+## Security Group Quick Reference
+
+```bash
+# Create SG (no vpc_id needed)
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# Add SSH rule
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md

@@ -1,59 +1,59 @@
-# Security Group Rules
-
-## Security Group is NOT bound to VPC
-
-VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
-
-```bash
-# CORRECT — no vpc_id needed
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-
-# WRONG
-hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
-```
-
-## KooCLI 7.x Nested Parameter Format
-
-Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
-
-## Create Security Group Rule
-
-Complete example with nested prefix:
-```bash
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-
-> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
-
-## Stateful vs Stateless
-
-| Feature | Security Group | Network ACL |
-|---------|---------------|-------------|
-| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
-| Applied to | ECS instance NIC | Subnet |
-| Rules | Allow only | Allow and Deny |
-| Default | Deny all inbound, allow all outbound | Allow all |
-
-## Common Rules Reference
-
-| Direction | Protocol | Port | Source | Purpose |
-|-----------|----------|------|--------|---------|
-| Ingress | TCP | 22 | <office-ip>/32 | SSH |
-| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
-| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
-| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
-| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
-| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
-
-## Common Errors
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
-| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
-| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |
+# Security Group Rules
+
+## Security Group is NOT bound to VPC
+
+VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
+
+```bash
+# CORRECT — no vpc_id needed
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# WRONG
+hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
+```
+
+## KooCLI 7.x Nested Parameter Format
+
+Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
+
+## Create Security Group Rule
+
+Complete example with nested prefix:
+```bash
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
+
+## Stateful vs Stateless
+
+| Feature | Security Group | Network ACL |
+|---------|---------------|-------------|
+| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
+| Applied to | ECS instance NIC | Subnet |
+| Rules | Allow only | Allow and Deny |
+| Default | Deny all inbound, allow all outbound | Allow all |
+
+## Common Rules Reference
+
+| Direction | Protocol | Port | Source | Purpose |
+|-----------|----------|------|--------|---------|
+| Ingress | TCP | 22 | <office-ip>/32 | SSH |
+| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
+| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
+| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
+| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
+| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
+
+## Common Errors
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
+| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md

@@ -1,63 +1,63 @@
----
-name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
-version: 1
----
-
-# Huawei Cloud WAF / AAD
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
-
-## Overview
-
-Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
-| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
-
-## Common Workflows
-
-### WAF
-
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
-| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
-
-### AAD
-
-```bash
-hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
-hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
-```
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
-
-## Security
-
-- MUST use WAF for all public-facing web applications
-- SHOULD enable AAD for DDoS protection
-- MUST test WAF rules in report-only mode before blocking
-
-## Cross-Skill References
-
-- **EIP**: See `huawei-vpc` for elastic IP binding
-- **DNS/CNAME**: Configure via your DNS provider
+---
+name: huawei-waf-aad
+description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+version: 1
+---
+
+# Huawei Cloud WAF / AAD
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
+
+## Overview
+
+Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
+| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
+| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+
+## Common Workflows
+
+### WAF
+
+| Task | Operation |
+|------|-----------|
+| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
+| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
+| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+
+### AAD
+
+```bash
+hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
+hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+```
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
+| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+
+## Security
+
+- MUST use WAF for all public-facing web applications
+- SHOULD enable AAD for DDoS protection
+- MUST test WAF rules in report-only mode before blocking
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for elastic IP binding
+- **DNS/CNAME**: Configure via your DNS provider

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+interface:
+  display_name: "Huawei Cloud API And SDK"
+  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
+  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."