huaweicloud-devkit 1.0.2-dev.8 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md

@@ -1,76 +1,76 @@
-# VPC Network Management Reference
-
-## DNS Addresses by Region
-
-Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
-
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
-| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
-
-**Subnet create with DNS**:
-```bash
-hcloud VPC CreateSubnet \
-  --subnet.name=<name> \
-  --subnet.vpc_id=<id> \
-  --subnet.cidr=10.50.1.0/24 \
-  --subnet.gateway_ip=10.50.1.1 \
-  --subnet.availability_zone=<az> \
-  --subnet.dnsList.1=100.125.1.250 \
-  --subnet.dnsList.2=100.125.129.250
-```
-
-## Nested Prefix Summary
-
-KooCLI 7.x VPC API requires nested prefixes:
-
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
-
-## EIP Management
-
-```bash
-# Create EIP (pay-per-use)
-hcloud EIP CreatePublicip --publicip.type=<type> \
-  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
-
-# Bind to ECS (PORT type, not ECS)
-hcloud EIP AssociatePublicips --publicip_id=<id> \
-  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
-
-# Unbind
-hcloud EIP DisassociatePublicip --publicip_id=<id>
-
-# List
-hcloud EIP ListPublicips
-
-# Delete (unbind first)
-hcloud EIP DeletePublicip --publicip_id=<id>
-```
-
-> EIP bills even when not bound. Release unused EIPs.
-
-## Security Group Quick Reference
-
-```bash
-# Create SG (no vpc_id needed)
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-
-# Add SSH rule
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-
-> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.
+# VPC Network Management Reference
+
+## DNS Addresses by Region
+
+Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
+
+| Region | Primary DNS | Secondary DNS |
+|--------|------------|---------------|
+| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
+| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
+
+**Subnet create with DNS**:
+```bash
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<id> \
+  --subnet.cidr=10.50.1.0/24 \
+  --subnet.gateway_ip=10.50.1.1 \
+  --subnet.availability_zone=<az> \
+  --subnet.dnsList.1=100.125.1.250 \
+  --subnet.dnsList.2=100.125.129.250
+```
+
+## Nested Prefix Summary
+
+KooCLI 7.x VPC API requires nested prefixes:
+
+| Resource | Create Param Prefix | Example |
+|----------|---------------------|---------|
+| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
+| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.` | `--security_group.name=sg-web` |
+| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
+
+## EIP Management
+
+```bash
+# Create EIP (pay-per-use)
+hcloud EIP CreatePublicip --publicip.type=<type> \
+  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
+
+# Bind to ECS (PORT type, not ECS)
+hcloud EIP AssociatePublicips --publicip_id=<id> \
+  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+
+# Unbind
+hcloud EIP DisassociatePublicip --publicip_id=<id>
+
+# List
+hcloud EIP ListPublicips
+
+# Delete (unbind first)
+hcloud EIP DeletePublicip --publicip_id=<id>
+```
+
+> EIP bills even when not bound. Release unused EIPs.
+
+## Security Group Quick Reference
+
+```bash
+# Create SG (no vpc_id needed)
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# Add SSH rule
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md

@@ -1,59 +1,59 @@
-# Security Group Rules
-
-## Security Group is NOT bound to VPC
-
-VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
-
-```bash
-# CORRECT — no vpc_id needed
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-
-# WRONG
-hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
-```
-
-## KooCLI 7.x Nested Parameter Format
-
-Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
-
-## Create Security Group Rule
-
-Complete example with nested prefix:
-```bash
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-
-> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
-
-## Stateful vs Stateless
-
-| Feature | Security Group | Network ACL |
-|---------|---------------|-------------|
-| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
-| Applied to | ECS instance NIC | Subnet |
-| Rules | Allow only | Allow and Deny |
-| Default | Deny all inbound, allow all outbound | Allow all |
-
-## Common Rules Reference
-
-| Direction | Protocol | Port | Source | Purpose |
-|-----------|----------|------|--------|---------|
-| Ingress | TCP | 22 | <office-ip>/32 | SSH |
-| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
-| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
-| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
-| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
-| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
-
-## Common Errors
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
-| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
-| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |
+# Security Group Rules
+
+## Security Group is NOT bound to VPC
+
+VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
+
+```bash
+# CORRECT — no vpc_id needed
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+
+# WRONG
+hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
+```
+
+## KooCLI 7.x Nested Parameter Format
+
+Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
+
+## Create Security Group Rule
+
+Complete example with nested prefix:
+```bash
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+
+> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
+
+## Stateful vs Stateless
+
+| Feature | Security Group | Network ACL |
+|---------|---------------|-------------|
+| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
+| Applied to | ECS instance NIC | Subnet |
+| Rules | Allow only | Allow and Deny |
+| Default | Deny all inbound, allow all outbound | Allow all |
+
+## Common Rules Reference
+
+| Direction | Protocol | Port | Source | Purpose |
+|-----------|----------|------|--------|---------|
+| Ingress | TCP | 22 | <office-ip>/32 | SSH |
+| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
+| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
+| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
+| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
+| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
+
+## Common Errors
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
+| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |

package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md

@@ -1,50 +1,50 @@
-# VPC Subnet Guide
-
-## Prerequisite: VPC CIDR is Immutable
-
-VPC CIDR block cannot be changed after creation. Plan carefully.
-
-## KooCLI 7.x Nested Parameter Format
-
-VPC API uses nested prefix: `--vpc.name`, `--subnet.vpc_id`, `--subnet.name`. NOT `--name` or `--vpc_id`.
-
-```bash
-# CORRECT
-hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=192.168.0.0/16
-
-hcloud VPC CreateSubnet \
-  --subnet.name=<name> \
-  --subnet.vpc_id=<vpc-id> \
-  --subnet.cidr=192.168.1.0/24 \
-  --subnet.gateway_ip=192.168.1.1 \
-  --subnet.availability_zone=<az>
-
-# WRONG — will fail with [USE_ERROR]
-hcloud VPC CreateVpc --name=xxx
-hcloud VPC CreateSubnet --vpc_id=xxx
-```
-
-## Key Constraints
-
-| Constraint | Detail |
-|-----------|--------|
-| Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
-| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
-| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
-| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
-
-## Common Errors
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
-| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
-| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
-
-## CIDR Planning Reference
-
-| Environment | VPC CIDR | Subnet CIDR |
-|------------|----------|-------------|
-| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
-| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
-| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |
+# VPC Subnet Guide
+
+## Prerequisite: VPC CIDR is Immutable
+
+VPC CIDR block cannot be changed after creation. Plan carefully.
+
+## KooCLI 7.x Nested Parameter Format
+
+VPC API uses nested prefix: `--vpc.name`, `--subnet.vpc_id`, `--subnet.name`. NOT `--name` or `--vpc_id`.
+
+```bash
+# CORRECT
+hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=192.168.0.0/16
+
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<vpc-id> \
+  --subnet.cidr=192.168.1.0/24 \
+  --subnet.gateway_ip=192.168.1.1 \
+  --subnet.availability_zone=<az>
+
+# WRONG — will fail with [USE_ERROR]
+hcloud VPC CreateVpc --name=xxx
+hcloud VPC CreateSubnet --vpc_id=xxx
+```
+
+## Key Constraints
+
+| Constraint | Detail |
+|-----------|--------|
+| Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
+| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
+| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
+| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
+
+## Common Errors
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
+| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
+| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
+
+## CIDR Planning Reference
+
+| Environment | VPC CIDR | Subnet CIDR |
+|------------|----------|-------------|
+| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
+| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
+| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md

@@ -1,63 +1,63 @@
----
-name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
-version: 1
----
-
-# Huawei Cloud WAF / AAD
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
-
-## Overview
-
-Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
-| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
-
-## Common Workflows
-
-### WAF
-
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
-| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
-
-### AAD
-
-```bash
-hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
-hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
-```
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
-
-## Security
-
-- MUST use WAF for all public-facing web applications
-- SHOULD enable AAD for DDoS protection
-- MUST test WAF rules in report-only mode before blocking
-
-## Cross-Skill References
-
-- **EIP**: See `huawei-vpc` for elastic IP binding
-- **DNS/CNAME**: Configure via your DNS provider
+---
+name: huawei-waf-aad
+description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+version: 1
+---
+
+# Huawei Cloud WAF / AAD
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
+
+## Overview
+
+Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
+| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
+| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+
+## Common Workflows
+
+### WAF
+
+| Task | Operation |
+|------|-----------|
+| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
+| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
+| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+
+### AAD
+
+```bash
+hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
+hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+```
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
+| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+
+## Security
+
+- MUST use WAF for all public-facing web applications
+- SHOULD enable AAD for DDoS protection
+- MUST test WAF rules in report-only mode before blocking
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for elastic IP binding
+- **DNS/CNAME**: Configure via your DNS provider

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md

@@ -1,56 +1,56 @@
----
-name: huaweicloud-api-and-sdk
-description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
----
-
-# Huawei Cloud API And SDK
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill when the deliverable is application code, API integration, or precise request construction.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
-| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
-| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
-| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
-| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
-
-## API Workflow
-
-1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
-2. Verify the exact request body and response schema from official API documentation.
-3. Handle pagination explicitly. Do not assume a single page.
-4. Preserve `request_id` from errors and responses for troubleshooting.
-5. Classify operation risk before running a live call.
-6. For write APIs, produce a dry plan and ask the user before execution.
-
-## SDK Workflow
-
-1. Pick the SDK that matches the user's application language and existing dependency style.
-2. Use the official SDK client for the target service.
-3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
-4. Add timeout, retry, and pagination handling.
-5. Return typed or structured results instead of unbounded raw logs.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
-| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
-| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
-| Empty results | Pagination missing — add `limit` and check `marker` |
-| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
-
-## Terraform Priority
-
-Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
-
-## Cross-Skill References
-
-- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
-- **Safety**: See `huaweicloud-safety` for write operation approval flow
+---
+name: huaweicloud-api-and-sdk
+description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
+---
+
+# Huawei Cloud API And SDK
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill when the deliverable is application code, API integration, or precise request construction.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
+| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
+| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
+| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
+| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
+
+## API Workflow
+
+1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
+2. Verify the exact request body and response schema from official API documentation.
+3. Handle pagination explicitly. Do not assume a single page.
+4. Preserve `request_id` from errors and responses for troubleshooting.
+5. Classify operation risk before running a live call.
+6. For write APIs, produce a dry plan and ask the user before execution.
+
+## SDK Workflow
+
+1. Pick the SDK that matches the user's application language and existing dependency style.
+2. Use the official SDK client for the target service.
+3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
+4. Add timeout, retry, and pagination handling.
+5. Return typed or structured results instead of unbounded raw logs.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
+| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
+| Empty results | Pagination missing — add `limit` and check `marker` |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
+
+## Terraform Priority
+
+Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
+
+## Cross-Skill References
+
+- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
+- **Safety**: See `huaweicloud-safety` for write operation approval flow

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+interface:
+  display_name: "Huawei Cloud API And SDK"
+  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
+  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."