huaweicloud-devkit 1.0.2-next.3 → 1.0.3-dev.0

package/plugins/huaweicloud-core/skills/huawei-waf-aad/SKILL.md

@@ -1,63 +1,63 @@
----
-name: huawei-waf-aad
-description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
-version: 1
----
-
-# Huawei Cloud WAF / AAD
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
-
-## Overview
-
-Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
-| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
-| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
-| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
-
-## Common Workflows
-
-### WAF
-
-| Task | Operation |
-|------|-----------|
-| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
-| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
-| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
-| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
-| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
-
-### AAD
-
-```bash
-hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
-hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
-```
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
-| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
-| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
-
-## Security
-
-- MUST use WAF for all public-facing web applications
-- SHOULD enable AAD for DDoS protection
-- MUST test WAF rules in report-only mode before blocking
-
-## Cross-Skill References
-
-- **EIP**: See `huawei-vpc` for elastic IP binding
-- **DNS/CNAME**: Configure via your DNS provider
+---
+name: huawei-waf-aad
+description: "Use when configuring Web Application Firewall (WAF) policies/rules, or Anti-DDoS (AAD) protection on Huawei Cloud. Triggers: WAF, AAD, firewall, DDoS, web protection, IP blacklist, rate limiting, CC attack. NOT for: security groups (use huawei-vpc), CTS audit (use huawei-cts)."
+version: 1
+---
+
+# Huawei Cloud WAF / AAD
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud WAF <Operation> --help` before constructing commands to discover exact parameter names and requirements. For AAD operations, use `hcloud AAD --help`.
+
+## Overview
+
+Domain expertise for WAF and Anti-DDoS. Covers WAF policy/rules, AAD protection, IP whitelist/blacklist, and rate limiting.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| WAF needs CNAME redirect | DNS must point to WAF endpoint, not server IP |
+| Premium instance required | Cloud WAF needs a dedicated/premium WAF instance |
+| AAD Standard vs Enterprise | Standard protects single IP. Enterprise protects entire IP ranges |
+| Rule order matters | WAF rules evaluated top-to-bottom within a policy |
+
+## Common Workflows
+
+### WAF
+
+| Task | Operation |
+|------|-----------|
+| List WAF instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| List policies | `ListPolicies --cli-region=<r> --project_id=<p>` |
+| Create custom rule | `BatchCreateCustomRule --cli-region=<r> --project_id=<p>` |
+| Create IP blacklist | `BatchCreateWhiteblackipRule --cli-region=<r> --project_id=<p>` |
+| Create CC rule | `BatchCreateCcRule --cli-region=<r> --project_id=<p>` |
+| Create geo rule | `BatchCreateGeoIpRule --cli-region=<r> --project_id=<p>` |
+
+### AAD
+
+```bash
+hcloud AAD ListInstances --cli-region=<r> --project_id=<p>
+hcloud AAD CreateInstance --cli-region=<r> --project_id=<p>
+```
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Website unreachable after WAF | Check CNAME record points to WAF endpoint |
+| WAF blocking legitimate traffic | Check rules order, adjust false positive settings |
+| AAD not responding | Standard AAD only protects single EIP. Check EIP binding |
+
+## Security
+
+- MUST use WAF for all public-facing web applications
+- SHOULD enable AAD for DDoS protection
+- MUST test WAF rules in report-only mode before blocking
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for elastic IP binding
+- **DNS/CNAME**: Configure via your DNS provider

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/SKILL.md

@@ -1,56 +1,56 @@
----
-name: huaweicloud-api-and-sdk
-description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
----
-
-# Huawei Cloud API And SDK
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill when the deliverable is application code, API integration, or precise request construction.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
-| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
-| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
-| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
-| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
-
-## API Workflow
-
-1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
-2. Verify the exact request body and response schema from official API documentation.
-3. Handle pagination explicitly. Do not assume a single page.
-4. Preserve `request_id` from errors and responses for troubleshooting.
-5. Classify operation risk before running a live call.
-6. For write APIs, produce a dry plan and ask the user before execution.
-
-## SDK Workflow
-
-1. Pick the SDK that matches the user's application language and existing dependency style.
-2. Use the official SDK client for the target service.
-3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
-4. Add timeout, retry, and pagination handling.
-5. Return typed or structured results instead of unbounded raw logs.
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
-| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
-| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
-| Empty results | Pagination missing — add `limit` and check `marker` |
-| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
-
-## Terraform Priority
-
-Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
-
-## Cross-Skill References
-
-- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
-- **Safety**: See `huaweicloud-safety` for write operation approval flow
+---
+name: huaweicloud-api-and-sdk
+description: Huawei Cloud API and SDK guidance for application development. Use when writing code that calls Huawei Cloud services, choosing SDKs, building API requests, handling project_id, endpoint, auth, pagination, retries, error codes, or request IDs.
+---
+
+# Huawei Cloud API And SDK
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill when the deliverable is application code, API integration, or precise request construction.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| `project_id` in path for most services | Many Huawei Cloud APIs require `project_id` in the URL path. Get it from IAM or KooCLI profile |
+| Pagination is not automatic | APIs return paginated results. Always check for `next_marker` or `page_info` to avoid partial data |
+| AK/SK signing algorithm | Huawei Cloud uses HMAC-SHA256 signing with specific header ordering. Use SDK, don't implement manually |
+| Endpoint varies by service and region | Always verify at https://developer.huaweicloud.com/endpoint |
+| Error response in `body` not HTTP status | Many errors return HTTP 200 with error details in the JSON body. Check `error_code` or `error_msg` fields |
+
+## API Workflow
+
+1. Identify service, region, endpoint, API version, and whether `project_id` is required in the path.
+2. Verify the exact request body and response schema from official API documentation.
+3. Handle pagination explicitly. Do not assume a single page.
+4. Preserve `request_id` from errors and responses for troubleshooting.
+5. Classify operation risk before running a live call.
+6. For write APIs, produce a dry plan and ask the user before execution.
+
+## SDK Workflow
+
+1. Pick the SDK that matches the user's application language and existing dependency style.
+2. Use the official SDK client for the target service.
+3. Keep credentials out of source code. Use environment, profile, workload identity, or runtime secret injection.
+4. Add timeout, retry, and pagination handling.
+5. Return typed or structured results instead of unbounded raw logs.
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Invalid project_id | Wrong or missing project_id in URL path. Use `hcloud IAM KeystoneListProjects` or KooCLI profile |
+| 401/AuthFailure | Expired AK/SK or wrong signing algorithm. Regenerate AK/SK or check SDK version |
+| 403/Forbidden | IAM permission missing. Check user/role has required action permissions |
+| Empty results | Pagination missing — add `limit` and check `marker` |
+| Endpoint not reachable | Wrong region/service endpoint. Verify at developer.huaweicloud.com/endpoint |
+
+## Terraform Priority
+
+Terraform Provider is low priority in V1. Mention it when the user needs reviewed, repeatable infrastructure changes. Do not default to Terraform for quick discovery or app-level SDK integration.
+
+## Cross-Skill References
+
+- **CLI setup**: See `huaweicloud-cli-and-auth` for KooCLI credential setup
+- **Safety**: See `huaweicloud-safety` for write operation approval flow

package/plugins/huaweicloud-core/skills/huaweicloud-api-and-sdk/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud API And SDK"
-  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
-  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."
+interface:
+  display_name: "Huawei Cloud API And SDK"
+  short_description: "Build correct Huawei Cloud API requests and SDK integrations."
+  default_prompt: "Use $huaweicloud-api-and-sdk to plan this Huawei Cloud API or SDK integration."

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/SKILL.md

@@ -1,51 +1,47 @@
----
-name: huaweicloud-capability-discovery
-description: Discover Huawei Cloud capabilities for an agent task. Use when the user asks what Huawei Cloud service, Skill, CLI command, API, SDK, or document should be used, or when a request is scenario-shaped and needs capability selection before implementation.
----
-
-# Huawei Cloud Capability Discovery
-
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
-
-## Workflow
-
-1. Classify the goal: application hosting, compute, container, serverless, storage, database, network, security, observability, AI, data, migration, cost, or troubleshooting.
-2. Search Huawei Cloud Skills first when the task is scenario-based or operational.
-3. Use official docs for exact service limits, API request/response fields, regions, and pricing-sensitive behavior.
-4. Prefer KooCLI for local read-only discovery after auth is configured.
-5. Before using KooCLI, discover exact operation names with `hcloud <Service> --help`; do not guess from intuition. Examples: list ECS instances with `ECS ListServersDetails`, create ECS with `ECS CreateServers`, inspect images through `IMS GlanceShowImage`.
-6. Prefer SDK docs when the deliverable is application code.
-7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
-8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
-9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
-
-## Deployment Target Options
-
-When the intent is to **deploy, host, or preview a web app or static website** and the developer has not named a target, do NOT default to OBS or any single service. Present the options and let the developer choose, recommending the sandbox first: ① huawei-sandbox (recommended — temporary runtime, instant preview URL) ② huawei-obs (long-term static hosting/CDN) ③ huawei-ecs ④ huawei-cce. Only follow an explicit target when the developer names one.
-
-## Region Intent
-
-- Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.
-- Target operation region wins over reference-resource uncertainty. If the user says "buy ECS in Singapore, reference SSY", inspect Singapore first.
-- No blind all-region scans. If the reference resource location is unknown and the target region is not enough, ask the user for the region instead of scanning unrelated regions.
-- For unfamiliar names, check Huawei Cloud API Explorer or official endpoint documentation for the region and service endpoint mapping.
-
-## Output Format
-
-When routing a task, return:
-
-- `intent`: one concise sentence
-- `recommended_path`: Skills, CLI, API, SDK, MCP, or Terraform
-- `why`: why this path is shortest and safest
-- `next_action`: exact next command, document lookup, or code file to inspect
-- `risk`: read-only, write, secret, permission, cost, or public exposure
-
-## Avoid
-
-- Do not guess a service when Huawei Cloud Skills or official docs should be checked.
-- Do not load many service references. Pick the next one that matches the intent.
-- Do not propose write operations before the user has seen the plan.
-- Do not query every region just to find a reference resource.
+---
+name: huaweicloud-capability-discovery
+description: Discover Huawei Cloud capabilities for an agent task. Use when the user asks what Huawei Cloud service, Skill, CLI command, API, SDK, or document should be used, or when a request is scenario-shaped and needs capability selection before implementation.
+---
+
+# Huawei Cloud Capability Discovery
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill to turn vague developer intent into a precise Huawei Cloud capability path.
+
+## Workflow
+
+1. Classify the goal: application hosting, compute, container, serverless, storage, database, network, security, observability, AI, data, migration, cost, or troubleshooting.
+2. Search Huawei Cloud Skills first when the task is scenario-based or operational.
+3. Use official docs for exact service limits, API request/response fields, regions, and pricing-sensitive behavior.
+4. Prefer KooCLI for local read-only discovery after auth is configured.
+5. Before using KooCLI, discover exact operation names with `hcloud <Service> --help`; do not guess from intuition. Examples: list ECS instances with `ECS ListServersDetails`, create ECS with `ECS CreateServers`, inspect images through `IMS GlanceShowImage`.
+6. Prefer SDK docs when the deliverable is application code.
+7. Prefer MCP only when an approved Huawei Cloud MCP tool exists for the needed operation.
+8. Treat Terraform as a secondary V1 path for reviewed IaC, not the default.
+9. When no built-in devkit skill matches, browse the community skill marketplace at https://github.com/huaweicloud/huaweicloud-skills. Fetch the index from https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills-index/index.json.
+
+## Region Intent
+
+- Extract region intent from the user's words before querying. Examples: Singapore -> `ap-southeast-3` first, Hong Kong -> `ap-southeast-2`, Beijing -> `cn-north-4`, Shanghai -> `cn-east-3`.
+- Target operation region wins over reference-resource uncertainty. If the user says "buy ECS in Singapore, reference SSY", inspect Singapore first.
+- No blind all-region scans. If the reference resource location is unknown and the target region is not enough, ask the user for the region instead of scanning unrelated regions.
+- For unfamiliar names, check Huawei Cloud API Explorer or official endpoint documentation for the region and service endpoint mapping.
+
+## Output Format
+
+When routing a task, return:
+
+- `intent`: one concise sentence
+- `recommended_path`: Skills, CLI, API, SDK, MCP, or Terraform
+- `why`: why this path is shortest and safest
+- `next_action`: exact next command, document lookup, or code file to inspect
+- `risk`: read-only, write, secret, permission, cost, or public exposure
+
+## Avoid
+
+- Do not guess a service when Huawei Cloud Skills or official docs should be checked.
+- Do not load many service references. Pick the next one that matches the intent.
+- Do not propose write operations before the user has seen the plan.
+- Do not query every region just to find a reference resource.

package/plugins/huaweicloud-core/skills/huaweicloud-capability-discovery/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Capability Discovery"
-  short_description: "Find the right Huawei Cloud capability path for a developer task."
-  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."
+interface:
+  display_name: "Huawei Cloud Capability Discovery"
+  short_description: "Find the right Huawei Cloud capability path for a developer task."
+  default_prompt: "Use $huaweicloud-capability-discovery to route this scenario to Huawei Cloud capabilities."

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/SKILL.md

@@ -1,128 +1,128 @@
----
-name: huaweicloud-cli-and-auth
-description: Safe Huawei Cloud KooCLI usage and authentication guidance. Use when working with hcloud, KooCLI, profiles, AK/SK, regions, projects, endpoints, CLI output, credential errors, or local Huawei Cloud account context.
----
-
-# Huawei Cloud CLI And Auth
-
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the user to paste AK/SK, SK, tokens, passwords, or credential files into chat.
-
-## Install KooCLI
-
-Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
-
-### Windows
-1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
-2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
-3. Verify: `hcloud version`
-
-### Linux (amd64 / arm64)
-One-liner (recommended):
-```bash
-curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
-```
-Or manual download:
-```bash
-# amd64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
-tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
-# arm64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
-tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
-```
-Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
-Verify: `hcloud version`
-
-### macOS (amd64 / arm64)
-One-liner (recommended):
-```bash
-curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
-```
-Or manual download:
-```bash
-# amd64
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
-tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
-# arm64 (Apple Silicon)
-curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
-tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
-```
-Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
-Verify: `hcloud version`
-
-Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `hcloud`, restart after updating `PATH`, or set `HCLOUD_BIN`.
-
-## Configure Credentials Outside Chat
-
-**NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
-
-- Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
-- **Unified credentials** (preferred): `npx huaweicloud-devkit auth init`. This is the DevKit's primary auth path; `hcloud configure init` only covers KooCLI.
-- **KooCLI only, interactive** (SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
-- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
-- If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
-- Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
-- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
-
-## Safe Flow
-
-1. Check whether `hcloud` is installed.
-2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
-3. Ask the user to configure credentials outside the agent conversation when setup is needed.
-4. Inspect profile and region only through redacted tooling.
-5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
-6. Use `--cli-output=json` for machine-readable responses when supported.
-7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
-8. Classify every command before running it:
-   - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
-   - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
-   - Secret: any operation returning secret string, binary secret, token, or password.
-9. For write operations, show the exact command and ask for explicit approval.
-
-## KooCLI Syntax Notes
-
-- Prefer `--param=value`; KooCLI 7.x may reject some space-separated parameter forms.
-- Array-style parameters use 1-based indexes, for example `--server.nics.1.subnet_id=<subnet-id>`, not `.0`.
-- For ECS creation, first inspect help: `hcloud ECS CreateServers --help`.
-- Minimal create shape to refine after help lookup:
-
-```bash
-hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type>
-```
-
-If a command needs an `adminPass` or other password field, do not leave plaintext secrets in shell history. Prefer local-only input or runtime injection.
-
-## Output Formatting
-
-```bash
-# JSON format (recommended for Agent)
-hcloud <Service> <Op> --cli-output=json
-
-# Table format (manual viewing)
-hcloud <Service> <Op> --cli-output=table
-
-# JMESPath filtering (extract specific fields)
-hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'].{ID:id,Name:name}"
-
-# Debug mode (when commands fail)
-hcloud <Service> <Op> --cli-debug=true
-```
-
-## Preferred Toolkit Tools
-
-- `huaweicloud_check_cli`
-- `huaweicloud_show_profile_redacted`
-- `huaweicloud_plan_cli_command`
-- `huaweicloud_run_readonly_command`
-- `huaweicloud_list_operations`
-- `huaweicloud_run_approved_command`
-
-## Do Not Run Directly
-
-- Raw `hcloud configure show/list/get/export` in agent tools.
-- Commands reading `.hcloud` or `.huaweicloud` files.
-- Commands dumping cloud credential environment variables.
-- Secret value reads such as CSMS `ShowSecretVersion`.
+---
+name: huaweicloud-cli-and-auth
+description: Safe Huawei Cloud KooCLI usage and authentication guidance. Use when working with hcloud, KooCLI, profiles, AK/SK, regions, projects, endpoints, CLI output, credential errors, or local Huawei Cloud account context.
+---
+
+# Huawei Cloud CLI And Auth
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use KooCLI `hcloud` for local inspection and reviewed operations. Never ask the user to paste AK/SK, SK, tokens, passwords, or credential files into chat.
+
+## Install KooCLI
+
+Official guide: `https://support.huaweicloud.com/qs-hcli/hcli_02_003.html`.
+
+### Windows
+1. Download and unzip: `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`
+2. Extract to `%USERPROFILE%\hcloud`, add to user `PATH`
+3. Verify: `hcloud version`
+
+### Linux (amd64 / arm64)
+One-liner (recommended):
+```bash
+curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
+```
+Or manual download:
+```bash
+# amd64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
+tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
+# arm64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
+tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
+```
+Move to PATH: `mv $(pwd)/hcloud ~/.local/bin/`
+Verify: `hcloud version`
+
+### macOS (amd64 / arm64)
+One-liner (recommended):
+```bash
+curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
+```
+Or manual download:
+```bash
+# amd64
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
+tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
+# arm64 (Apple Silicon)
+curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
+tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
+```
+Move to PATH: `mv $(pwd)/hcloud /usr/local/bin/`
+Verify: `hcloud version`
+
+Agent processes find executables through `PATH`. If OpenCode/Codex cannot find `hcloud`, restart after updating `PATH`, or set `HCLOUD_BIN`.
+
+## Configure Credentials Outside Chat
+
+**NEVER let AK/SK enter shell history. This is the #1 credential leak vector.**
+
+- Create AK/SK in the Huawei Cloud console under `My Credentials -> Access Keys`.
+- **Unified credentials** (preferred): `npx huaweicloud-devkit auth init`. This is the DevKit's primary auth path; `hcloud configure init` only covers KooCLI.
+- **KooCLI only, interactive** (SAFE): `hcloud configure init` — prompts for AK/SK via terminal input. Values do NOT enter shell history.
+- **Non-interactive** (DANGEROUS — AK/SK in shell history): `hcloud configure set --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>`. Only use in ephemeral CI/CD shells. User must execute outside agent chat.
+- If MCP is available, use `huaweicloud_show_profile_redacted` to check status without ever seeing credentials.
+- Never paste AK/SK, passwords, tokens, or profile files into the agent conversation.
+- KooCLI stores credentials in `~/.hcloud/config.json`, NOT environment variables. `HCLOUD_ACCESS_KEY` / `HCLOUD_SECRET_KEY` / `HCLOUD_REGION` env vars are NOT read by KooCLI 7.x.
+
+## Safe Flow
+
+1. Check whether `hcloud` is installed.
+2. **KooCLI first-run privacy agreement**: On a fresh KooCLI install, `hcloud` blocks with `同意并继续使用(y)/不同意并退出(N)` and fails with `[USE_ERROR]您输入的是无效字符` in non-interactive mode. Detection: check command output for these strings. Ask the user: "KooCLI needs to accept its privacy agreement. May I accept it on your behalf?" If the user agrees, run `huaweicloud_run_readonly_command` with `args=["version"]` and `stdin="y\n"`. This accepts the agreement once, after which hcloud works normally.
+3. Ask the user to configure credentials outside the agent conversation when setup is needed.
+4. Inspect profile and region only through redacted tooling.
+5. Discover exact operation names with `hcloud <Service> --help` before guessing. Example: ECS instance listing is commonly `ECS ListServersDetails`; ECS creation is commonly `ECS CreateServers`; image lookup may be under `IMS GlanceShowImage`.
+6. Use `--cli-output=json` for machine-readable responses when supported.
+7. For resource operations, include `--cli-region`, `--cli-profile`, and service-specific project information when required.
+8. Classify every command before running it:
+   - Read-only: `List*`, `Show*`, `Get*`, `Describe*`.
+   - Write: `Create*`, `Delete*`, `Update*`, `Resize*`, `Start*`, `Stop*`, `Authorize*`, and similar.
+   - Secret: any operation returning secret string, binary secret, token, or password.
+9. For write operations, show the exact command and ask for explicit approval.
+
+## KooCLI Syntax Notes
+
+- Prefer `--param=value`; KooCLI 7.x may reject some space-separated parameter forms.
+- Array-style parameters use 1-based indexes, for example `--server.nics.1.subnet_id=<subnet-id>`, not `.0`.
+- For ECS creation, first inspect help: `hcloud ECS CreateServers --help`.
+- Minimal create shape to refine after help lookup:
+
+```bash
+hcloud ECS CreateServers --cli-region=<region> --server.name=<name> --server.flavorRef=<flavor-id> --server.imageRef=<image-id> --server.nics.1.subnet_id=<subnet-id> --server.root_volume.volumetype=<type>
+```
+
+If a command needs an `adminPass` or other password field, do not leave plaintext secrets in shell history. Prefer local-only input or runtime injection.
+
+## Output Formatting
+
+```bash
+# JSON format (recommended for Agent)
+hcloud <Service> <Op> --cli-output=json
+
+# Table format (manual viewing)
+hcloud <Service> <Op> --cli-output=table
+
+# JMESPath filtering (extract specific fields)
+hcloud <Service> <ListOp> --cli-output=json --cli-query "items[?status=='ACTIVE'].{ID:id,Name:name}"
+
+# Debug mode (when commands fail)
+hcloud <Service> <Op> --cli-debug=true
+```
+
+## Preferred Toolkit Tools
+
+- `huaweicloud_check_cli`
+- `huaweicloud_show_profile_redacted`
+- `huaweicloud_plan_cli_command`
+- `huaweicloud_run_readonly_command`
+- `huaweicloud_list_operations`
+- `huaweicloud_run_approved_command`
+
+## Do Not Run Directly
+
+- Raw `hcloud configure show/list/get/export` in agent tools.
+- Commands reading `.hcloud` or `.huaweicloud` files.
+- Commands dumping cloud credential environment variables.
+- Secret value reads such as CSMS `ShowSecretVersion`.

package/plugins/huaweicloud-core/skills/huaweicloud-cli-and-auth/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud CLI And Auth"
-  short_description: "Use KooCLI safely without exposing credentials."
-  default_prompt: "Use $huaweicloud-cli-and-auth to check KooCLI setup safely."
+interface:
+  display_name: "Huawei Cloud CLI And Auth"
+  short_description: "Use KooCLI safely without exposing credentials."
+  default_prompt: "Use $huaweicloud-cli-and-auth to check KooCLI setup safely."