huaweicloud-devkit 1.0.2-next.3 → 1.0.3-dev.0

package/plugins/huaweicloud-core/skills/huaweicloud-core/SKILL.md

@@ -1,111 +1,96 @@
----
-name: huaweicloud-core
-description: "Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud."
-version: 1
----
-
-# Huawei Cloud Core
-
-**STOP - Do not answer from general knowledge.** Before responding to any Huawei Cloud question, match the user request against the sub-skill registry below and follow its procedure. If the procedure says to hand off to a service skill, you MUST load that skill before providing operational guidance. Never skip the routing step.
-
-Huawei Cloud comprises 200+ services. This skill is the entry point for ANY action or question related to Huawei Cloud. It matches a workload to the right service, then hands off to a service-specific skill for operational questions.
-
-## How This Skill Works
-
-1. Match user intent against the Sub-skill registry below
-2. Read references/{sub-skill-id}.md and follow its procedure
-3. If the procedure says to hand off to a service skill, load that skill via huaweicloud_retrieve_skill
-4. If no match, use the Service Map to narrow down, then hand off
-5. Revise when new information arrives - pushback means re-check the registry
-
-Do not rely on training data for facts. Huawei Cloud services, pricing, quotas, and GA status change frequently. Verify against knowledge cards.
-
-## Sub-skill Registry
-
-| ID | Name | Trigger Phrases | Next Steps |
-|----|------|----------------|------------|
-| select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
-| compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
-| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS (long-term storage/CDN intent only) | Handoff to huawei-obs or huawei-cbr |
-| database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
-| network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
-| serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
-| ai | AI/ML Routing | AI, model, LLM, Pangu, training, inference, RAG | Handoff to huawei-modelarts |
-| messaging | Messaging Routing | message queue, notification, Kafka, RabbitMQ, event, SMN | Handoff to huawei-smn-dms |
-| security | Security Routing | secret, credential, encrypt, KMS, WAF, firewall, DDoS | Handoff to huawei-dew or huawei-waf-aad |
-| observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
-| billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
-| iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
-| deployment | Deployment Routing | deploy, host, publish, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy/host/preview a web app or static website (no CI/CD target) -> present deployment-target options first, see "Deployment Target Options" below |
-| sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
-| cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
-| safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
-| troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
-| api-sdk | API/SDK Routing | API call, SDK, REST, integration, code example | Handoff to huaweicloud-api-and-sdk |
-| report-issue | Issue Reporting | wrong service, you picked wrong, incorrect | Read references/report-issue.md |
-
-## Service Map
-
-| Workload | Primary Service | Skill |
-|----------|----------------|-------|
-| Web application hosting | ECS | huawei-ecs |
-| Containerized microservices | CCE | huawei-cce |
-| Static file storage / CDN (long-term) | OBS | huawei-obs |
-| Relational database (MySQL/PG) | RDS | huawei-rds |
-| Distributed SQL database | GaussDB | huawei-gaussdb |
-| Document database (MongoDB API) | DDS | huawei-dds-dcs |
-| In-memory cache | DCS (Redis) | huawei-dds-dcs |
-| Serverless functions | FunctionGraph | huawei-functiongraph |
-| API management | APIG | huawei-apig |
-| AI model training/inference | ModelArts | huawei-modelarts |
-| Message queuing | DMS (Kafka/RabbitMQ) | huawei-smn-dms |
-| Push notifications | SMN | huawei-smn-dms |
-| Secret management | DEW (CSMS) | huawei-dew |
-| Key management | DEW (KMS) | huawei-dew |
-| DDoS protection | AAD | huawei-waf-aad |
-| Web firewall | WAF | huawei-waf-aad |
-| Monitoring dashboards | Cloud Eye (CES) | huawei-cloud-eye |
-| Audit trails | CTS | huawei-cts |
-| Backup / disaster recovery | CBR | huawei-cbr |
-| CI/CD pipeline | CloudDeploy | huawei-deployment |
-| Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
-| Getting started | Account setup | huaweicloud-cli-and-auth |
-
-## Deployment Target Options
-
-When the intent is to **deploy, host, or preview a web app or static website** (no explicit target named), NEVER default to a single service such as OBS. Ask the developer to choose a target and present the options in this order:
-
-| # | Option | When to choose | Skill |
-|---|--------|----------------|-------|
-| 1 | **Sandbox (DevStation) — recommended** | Temporary runtime, quick preview, demo; instant public URL | huawei-sandbox |
-| 2 | OBS static website hosting | Long-term static hosting / CDN, no backend | huawei-obs |
-| 3 | ECS | Needs a server runtime (backend, custom server) | huawei-ecs |
-| 4 | CCE | Containerized workloads, scaling | huawei-cce |
-
-- Recommended prompt: "这个项目是 Web 应用/静态网站，建议优先部署到沙箱（临时运行环境，立即可预览）。也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？"
-- If the developer explicitly names a target (e.g. "deploy to OBS"), follow that target and hand off to the corresponding service skill.
-- If the developer has no preference, recommend the sandbox first.
-
-## Capability Sources
-
-- Huawei Cloud Skills: scenario workflows and recipes (check first)
-- External Marketplace: huaweicloud-capability-discovery for community skill search when no built-in skill matches
-- KooCLI hcloud: local inspection and reviewed command execution
-- API documentation: exact endpoint, request body, pagination, project_id
-- SDK documentation: application integration
-- MCP tools: huaweicloud_search_docs, huaweicloud_retrieve_skill, huaweicloud_list_regions
-- Terraform Provider: lower-priority V1 path for reviewed IaC
-
-## Tool Boundary
-
-- Use huaweicloud_search_docs to discover skills covering a topic
-- Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
-- If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
-- Use huaweicloud_list_regions before creating regional resources
-- Use huaweicloud_get_regional_availability when unsure about service-region pairs
-- Use huaweicloud_run_readonly_command for read-only inspection
-- Use huaweicloud_run_approved_command only after exact-command approval
-
-## Quality Bar
-
+---
+name: huaweicloud-core
+description: "Routes any task involving Huawei Cloud services - choosing, comparing, recommending, getting started with, or operating a service - to the correct service-specific skill. Supersedes general training-data knowledge. Activates when a developer asks Codex or OpenCode to build, deploy, debug, operate, or integrate an application with Huawei Cloud."
+version: 1
+---
+
+# Huawei Cloud Core
+
+**STOP - Do not answer from general knowledge.** Before responding to any Huawei Cloud question, match the user request against the sub-skill registry below and follow its procedure. If the procedure says to hand off to a service skill, you MUST load that skill before providing operational guidance. Never skip the routing step.
+
+Huawei Cloud comprises 200+ services. This skill is the entry point for ANY action or question related to Huawei Cloud. It matches a workload to the right service, then hands off to a service-specific skill for operational questions.
+
+## How This Skill Works
+
+1. Match user intent against the Sub-skill registry below
+2. Read references/{sub-skill-id}.md and follow its procedure
+3. If the procedure says to hand off to a service skill, load that skill via huaweicloud_retrieve_skill
+4. If no match, use the Service Map to narrow down, then hand off
+5. Revise when new information arrives - pushback means re-check the registry
+
+Do not rely on training data for facts. Huawei Cloud services, pricing, quotas, and GA status change frequently. Verify against knowledge cards.
+
+## Sub-skill Registry
+
+| ID | Name | Trigger Phrases | Next Steps |
+|----|------|----------------|------------|
+| select | Service Selection | which service, what should I use, compare, recommend | Read references/select.md | select
+| compute | Compute Routing | server, VM, instance, ECS, BMS, GPU, HPC | Handoff to huawei-ecs or huawei-cce |
+| storage | Storage Routing | store files, bucket, OBS, backup, disk, EVS, SFS | Handoff to huawei-obs or huawei-cbr |
+| database | Database Routing | database, SQL, NoSQL, cache, RDS, GaussDB, DDS, DCS | Handoff to huawei-rds or huawei-gaussdb |
+| network | Network Routing | VPC, subnet, security group, EIP, NAT, VPN | Handoff to huawei-vpc |
+| serverless | Serverless Routing | function, Lambda, serverless, FunctionGraph, API gateway | Handoff to huawei-functiongraph or huawei-apig |
+| ai | AI/ML Routing | AI, model, LLM, Pangu, training, inference, RAG | Handoff to huawei-modelarts |
+| messaging | Messaging Routing | message queue, notification, Kafka, RabbitMQ, event, SMN | Handoff to huawei-smn-dms |
+| security | Security Routing | secret, credential, encrypt, KMS, WAF, firewall, DDoS | Handoff to huawei-dew or huawei-waf-aad |
+| observability | Observability Routing | monitor, alarm, log, audit, trace, Cloud Eye | Handoff to huawei-cloud-eye or huawei-cts |
+| billing | Billing Routing | cost, bill, budget, spending, invoice | Handoff to huawei-billing |
+| iam | IAM Routing | permission, policy, role, user, group, AK/SK | Handoff to huawei-iam |
+| deployment | Deployment Routing | deploy, CI/CD, pipeline, release | CI/CD pipeline -> huawei-deployment; deploy a web app or a GitHub repo (no CI/CD target) -> huawei-sandbox |
+| sandbox | Sandbox Routing | sandbox, DevStation, workspace, terminal, preview, temporary runtime | Handoff to huawei-sandbox |
+| cli | CLI and Auth Routing | install hcloud, configure KooCLI, AK/SK setup | Handoff to huaweicloud-cli-and-auth |
+| safety | Safety Routing | is this safe, approve command, risk review | Handoff to huaweicloud-safety |
+| troubleshoot | Troubleshooting Routing | error, bug, failed, AccessDenied, quota | Handoff to huaweicloud-troubleshooting |
+| api-sdk | API/SDK Routing | API call, SDK, REST, integration, code example | Handoff to huaweicloud-api-and-sdk |
+| report-issue | Issue Reporting | wrong service, you picked wrong, incorrect | Read references/report-issue.md |
+
+## Service Map
+
+| Workload | Primary Service | Skill |
+|----------|----------------|-------|
+| Web application hosting | ECS | huawei-ecs |
+| Containerized microservices | CCE | huawei-cce |
+| Static file storage / CDN | OBS | huawei-obs |
+| Relational database (MySQL/PG) | RDS | huawei-rds |
+| Distributed SQL database | GaussDB | huawei-gaussdb |
+| Document database (MongoDB API) | DDS | huawei-dds-dcs |
+| In-memory cache | DCS (Redis) | huawei-dds-dcs |
+| Serverless functions | FunctionGraph | huawei-functiongraph |
+| API management | APIG | huawei-apig |
+| AI model training/inference | ModelArts | huawei-modelarts |
+| Message queuing | DMS (Kafka/RabbitMQ) | huawei-smn-dms |
+| Push notifications | SMN | huawei-smn-dms |
+| Secret management | DEW (CSMS) | huawei-dew |
+| Key management | DEW (KMS) | huawei-dew |
+| DDoS protection | AAD | huawei-waf-aad |
+| Web firewall | WAF | huawei-waf-aad |
+| Monitoring dashboards | Cloud Eye (CES) | huawei-cloud-eye |
+| Audit trails | CTS | huawei-cts |
+| Backup / disaster recovery | CBR | huawei-cbr |
+| CI/CD pipeline | CloudDeploy | huawei-deployment |
+| Temporary runtime / web app preview | Sandbox (DevStation) | huawei-sandbox |
+| Getting started | Account setup | huaweicloud-cli-and-auth |
+
+## Capability Sources
+
+- Huawei Cloud Skills: scenario workflows and recipes (check first)
+- External Marketplace: huaweicloud-capability-discovery for community skill search when no built-in skill matches
+- KooCLI hcloud: local inspection and reviewed command execution
+- API documentation: exact endpoint, request body, pagination, project_id
+- SDK documentation: application integration
+- MCP tools: huaweicloud_search_docs, huaweicloud_retrieve_skill, huaweicloud_list_regions
+- Terraform Provider: lower-priority V1 path for reviewed IaC
+
+## Tool Boundary
+
+- Use huaweicloud_search_docs to discover skills covering a topic
+- Use huaweicloud_retrieve_skill to load a full SKILL.md after routing
+- If no built-in skill matches, consult huaweicloud-capability-discovery for external marketplace options
+- Use huaweicloud_list_regions before creating regional resources
+- Use huaweicloud_get_regional_availability when unsure about service-region pairs
+- Use huaweicloud_run_readonly_command for read-only inspection
+- Use huaweicloud_run_approved_command only after exact-command approval
+
+## Quality Bar
+
 Prefer short, precise instructions with commands the developer can run. Give source names and exact fields to verify. Avoid inventing service behavior. When uncertain, route to Huawei Cloud Skills or official API/SDK documentation.

package/plugins/huaweicloud-core/skills/huaweicloud-core/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Core"
-  short_description: "Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform."
-  default_prompt: "Use $huaweicloud-core to choose the right Huawei Cloud capability path."
+interface:
+  display_name: "Huawei Cloud Core"
+  short_description: "Route Huawei Cloud tasks to Skills, CLI, API, SDK, MCP, or Terraform."
+  default_prompt: "Use $huaweicloud-core to choose the right Huawei Cloud capability path."

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/report-issue.md

@@ -1,20 +1,20 @@
-# Issue Reporting Procedure
-
-Use when the user reports an issue with a previous routing decision.
-
-## Procedure
-
-1. Acknowledge the feedback without defensiveness
-2. Re-check the Sub-skill registry for a better match
-3. If a different service is clearly right, load that skill
-4. If unclear, broaden the search: use huaweicloud_search_docs
-5. Document the mismatch so the registry can be improved
-
-## Common Corrections
-
-| Wrong Routing | Likely Correct |
-|---------------|---------------|
-| ECS for containers | CCE |
-| OBS for block storage | EVS (via huawei-ecs) |
-| RDS for cache | DCS (via huawei-dds-dcs) |
+# Issue Reporting Procedure
+
+Use when the user reports an issue with a previous routing decision.
+
+## Procedure
+
+1. Acknowledge the feedback without defensiveness
+2. Re-check the Sub-skill registry for a better match
+3. If a different service is clearly right, load that skill
+4. If unclear, broaden the search: use huaweicloud_search_docs
+5. Document the mismatch so the registry can be improved
+
+## Common Corrections
+
+| Wrong Routing | Likely Correct |
+|---------------|---------------|
+| ECS for containers | CCE |
+| OBS for block storage | EVS (via huawei-ecs) |
+| RDS for cache | DCS (via huawei-dds-dcs) |
 | FunctionGraph for long-running tasks | ECS or CCE |

package/plugins/huaweicloud-core/skills/huaweicloud-core/references/select.md

@@ -1,28 +1,28 @@
-# Service Selection Procedure
-
-Use when the user asks which service to use or compares services.
-
-## Decision Flow
-
-1. Classify workload: compute, storage, database, network, serverless, AI, messaging, security, observability
-2. Check Service Map in huaweicloud-core SKILL.md
-3. If multiple services match, ask clarifying questions:
-   - Expected scale (small demo vs production)
-   - Data model (relational vs document vs key-value)
-   - Latency requirements
-   - Budget constraints
-4. Present top 1-2 recommendations with rationale
-5. Hand off to the selected service skill
-
-## Example: I need a database
-
-Ask:
-- What type of data? Structured (tables) or flexible (documents)?
-- What scale? Small app or enterprise?
-- Do you need SQL queries?
-
-Route based on answers:
-- SQL + standard scale -> huawei-rds
-- SQL + massive scale / distributed -> huawei-gaussdb
-- Document model (MongoDB-compatible) -> huawei-dds-dcs
+# Service Selection Procedure
+
+Use when the user asks which service to use or compares services.
+
+## Decision Flow
+
+1. Classify workload: compute, storage, database, network, serverless, AI, messaging, security, observability
+2. Check Service Map in huaweicloud-core SKILL.md
+3. If multiple services match, ask clarifying questions:
+   - Expected scale (small demo vs production)
+   - Data model (relational vs document vs key-value)
+   - Latency requirements
+   - Budget constraints
+4. Present top 1-2 recommendations with rationale
+5. Hand off to the selected service skill
+
+## Example: I need a database
+
+Ask:
+- What type of data? Structured (tables) or flexible (documents)?
+- What scale? Small app or enterprise?
+- Do you need SQL queries?
+
+Route based on answers:
+- SQL + standard scale -> huawei-rds
+- SQL + massive scale / distributed -> huawei-gaussdb
+- Document model (MongoDB-compatible) -> huawei-dds-dcs
 - Cache / key-value -> huawei-dds-dcs (DCS)

package/plugins/huaweicloud-core/skills/huaweicloud-safety/SKILL.md

@@ -1,60 +1,60 @@
----
-name: huaweicloud-safety
-description: Huawei Cloud safety policy for agents. Use when handling credentials, secrets, IAM, public exposure, billing, destructive actions, scaling, write operations, hooks, command approval, output redaction, or risk review.
----
-
-# Huawei Cloud Safety
-
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.
-
-## Rules
-
-1. Never ask the user to paste AK/SK, SK, tokens, passwords, private keys, or credential files.
-2. Never read local `.hcloud` or `.huaweicloud` credential files into the agent context.
-3. Never call APIs or CLI operations that return secret values directly into the agent context.
-4. Always classify operations before execution:
-   - read-only
-   - write
-   - secret
-   - IAM/security
-   - cost/payment
-   - public exposure
-5. For any non-read-only operation, show the exact planned change and wait for explicit user approval.
-6. Redact secrets from command output, errors, JSON, logs, and generated reports.
-7. If a command contains `adminPass`, `password`, token, or any secret-like field, warn that plaintext can remain in shell history. Prefer local-only input, runtime injection, or user-side execution.
-
-## Enforcement Layers
-
-- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
-- MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
-- Skills: this document teaches agents the rule before they act.
-
-## Write Execution Boundary
-
-- Default path: use `huaweicloud_plan_cli_command` to produce a reviewed command block, then let the user or host agent execute it after approval.
-- Approved tool path: use `huaweicloud_run_approved_command` only when the exact planned command has been shown and the user explicitly approved that exact command.
-- After a write, verify with `huaweicloud_run_readonly_command` or another read-only check.
-
-## Proactive Hook Checks
-
-Before executing, deploying, or handing generated cloud artifacts to the user, run the matching check when available:
-
-- `huaweicloud_hook_check_command` for shell or KooCLI command text.
-- `huaweicloud_hook_check_artifacts` for generated policy, IaC, config, workflow, or deployment files.
-- `huaweicloud_hook_check_deploy_plan` for sandbox, preview, FunctionGraph, ECS, CCE, APIG, OBS, IAM, or cost-affecting plans.
-
-If the result is `deny`, repair the command, artifact, or deployment plan before execution. If the result is `warn`, show the warning to the user and repair or ask for explicit confirmation.
-
-## Static Analysis Boundary
-
-Hook checks inspect the command or plan text that is available before execution. If a command builds cloud parameters through shell variables, string concatenation, subshells, encoded payloads, or generated scripts, first expand the final command into reviewable text and run `huaweicloud_hook_check_command` on that final form. When the final values cannot be determined, stop and ask the user to review the expanded command or use `huaweicloud_plan_cli_command` before execution.
-
-## Safe Alternatives
-
-- Use redacted profile inspection instead of raw `hcloud configure show`.
-- Use runtime secret injection instead of fetching secret values into chat.
-- Use read-only verification after a write.
-- Prefer reviewed IaC for durable infrastructure changes.
+---
+name: huaweicloud-safety
+description: Huawei Cloud safety policy for agents. Use when handling credentials, secrets, IAM, public exposure, billing, destructive actions, scaling, write operations, hooks, command approval, output redaction, or risk review.
+---
+
+# Huawei Cloud Safety
+
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use this skill before any Huawei Cloud action that may expose secrets, change resources, affect cost, change IAM, or expose a network endpoint.
+
+## Rules
+
+1. Never ask the user to paste AK/SK, SK, tokens, passwords, private keys, or credential files.
+2. Never read local `.hcloud` or `.huaweicloud` credential files into the agent context.
+3. Never call APIs or CLI operations that return secret values directly into the agent context.
+4. Always classify operations before execution:
+   - read-only
+   - write
+   - secret
+   - IAM/security
+   - cost/payment
+   - public exposure
+5. For any non-read-only operation, show the exact planned change and wait for explicit user approval.
+6. Redact secrets from command output, errors, JSON, logs, and generated reports.
+7. If a command contains `adminPass`, `password`, token, or any secret-like field, warn that plaintext can remain in shell history. Prefer local-only input, runtime injection, or user-side execution.
+
+## Enforcement Layers
+
+- Hooks: `hooks/huaweicloud-safety.py` can block risky tool calls on platforms that support plugin hooks.
+- MCP wrapper: the Node MCP server applies the same safety policy for Codex/OpenCode paths that do not enforce hooks.
+- Skills: this document teaches agents the rule before they act.
+
+## Write Execution Boundary
+
+- Default path: use `huaweicloud_plan_cli_command` to produce a reviewed command block, then let the user or host agent execute it after approval.
+- Approved tool path: use `huaweicloud_run_approved_command` only when the exact planned command has been shown and the user explicitly approved that exact command.
+- After a write, verify with `huaweicloud_run_readonly_command` or another read-only check.
+
+## Proactive Hook Checks
+
+Before executing, deploying, or handing generated cloud artifacts to the user, run the matching check when available:
+
+- `huaweicloud_hook_check_command` for shell or KooCLI command text.
+- `huaweicloud_hook_check_artifacts` for generated policy, IaC, config, workflow, or deployment files.
+- `huaweicloud_hook_check_deploy_plan` for sandbox, preview, FunctionGraph, ECS, CCE, APIG, OBS, IAM, or cost-affecting plans.
+
+If the result is `deny`, repair the command, artifact, or deployment plan before execution. If the result is `warn`, show the warning to the user and repair or ask for explicit confirmation.
+
+## Static Analysis Boundary
+
+Hook checks inspect the command or plan text that is available before execution. If a command builds cloud parameters through shell variables, string concatenation, subshells, encoded payloads, or generated scripts, first expand the final command into reviewable text and run `huaweicloud_hook_check_command` on that final form. When the final values cannot be determined, stop and ask the user to review the expanded command or use `huaweicloud_plan_cli_command` before execution.
+
+## Safe Alternatives
+
+- Use redacted profile inspection instead of raw `hcloud configure show`.
+- Use runtime secret injection instead of fetching secret values into chat.
+- Use read-only verification after a write.
+- Prefer reviewed IaC for durable infrastructure changes.

package/plugins/huaweicloud-core/skills/huaweicloud-safety/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Safety"
-  short_description: "Keep Huawei Cloud agent operations safe and redacted."
-  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."
+interface:
+  display_name: "Huawei Cloud Safety"
+  short_description: "Keep Huawei Cloud agent operations safe and redacted."
+  default_prompt: "Use $huaweicloud-safety to review this Huawei Cloud operation."

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/SKILL.md

@@ -1,83 +1,83 @@
----
-name: huaweicloud-troubleshooting
-description: Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.
----
-
-# Huawei Cloud Troubleshooting
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |
-| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |
-| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
-| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |
-
-## Workflow
-
-1. Capture the redacted error message, service, operation, region, project_id, and request_id.
-2. Classify likely cause:
-   - auth or permission
-   - wrong region or endpoint
-   - wrong project_id
-   - missing resource
-   - quota or account limit
-   - invalid request body
-   - service-side failure
-3. Run the smallest read-only check that can prove or disprove the cause.
-4. Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.
-5. Propose one fix at a time.
-6. Verify with read-only observation after the fix.
-
-## Common Checks
-
-| Check | Command |
-|-------|---------|
-| Authentication | `hcloud configure list` (redacted) |
-| Region | Match CLI region, endpoint, and resource region |
-| Project ID | `hcloud IAM KeystoneListProjects` |
-| Pagination | Add `--limit=100` and check `marker` |
-| Quota | Check service quotas in console or API |
-| IAM Permission | Verify user/role has required action — see `huawei-iam` skill |
-| KooCLI version | `hcloud version` |
-
-## Common Error Codes
-
-| Error | Likely Cause | Fix |
-|-------|-------------|-----|
-| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
-| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
-| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
-| QuotaExceeded | Account limit reached | Request quota increase in console |
-| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
-| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
-| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
-| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
-| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
-| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
-
-## KooCLI Error Types
-
-KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
-
-| Type | Meaning | First Check |
-|------|---------|-------------|
-| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |
-| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |
-| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |
-| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |
-| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |
-
-Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.
-
-## Cross-Skill References
-
-- **IAM permissions**: See `huawei-iam`
-- **CLI auth setup**: See `huaweicloud-cli-and-auth`
-- **ECS specific errors**: See `huawei-ecs`
-- **FunctionGraph specific**: See `huawei-functiongraph`
+---
+name: huaweicloud-troubleshooting
+description: Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.
+---
+
+# Huawei Cloud Troubleshooting
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |
+| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |
+| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |
+| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |
+
+## Workflow
+
+1. Capture the redacted error message, service, operation, region, project_id, and request_id.
+2. Classify likely cause:
+   - auth or permission
+   - wrong region or endpoint
+   - wrong project_id
+   - missing resource
+   - quota or account limit
+   - invalid request body
+   - service-side failure
+3. Run the smallest read-only check that can prove or disprove the cause.
+4. Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.
+5. Propose one fix at a time.
+6. Verify with read-only observation after the fix.
+
+## Common Checks
+
+| Check | Command |
+|-------|---------|
+| Authentication | `hcloud configure list` (redacted) |
+| Region | Match CLI region, endpoint, and resource region |
+| Project ID | `hcloud IAM KeystoneListProjects` |
+| Pagination | Add `--limit=100` and check `marker` |
+| Quota | Check service quotas in console or API |
+| IAM Permission | Verify user/role has required action — see `huawei-iam` skill |
+| KooCLI version | `hcloud version` |
+
+## Common Error Codes
+
+| Error | Likely Cause | Fix |
+|-------|-------------|-----|
+| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |
+| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |
+| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |
+| QuotaExceeded | Account limit reached | Request quota increase in console |
+| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |
+| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |
+| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |
+| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |
+| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |
+| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |
+
+## KooCLI Error Types
+
+KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
+
+| Type | Meaning | First Check |
+|------|---------|-------------|
+| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |
+| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |
+| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |
+| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |
+| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |
+
+Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.
+
+## Cross-Skill References
+
+- **IAM permissions**: See `huawei-iam`
+- **CLI auth setup**: See `huaweicloud-cli-and-auth`
+- **ECS specific errors**: See `huawei-ecs`
+- **FunctionGraph specific**: See `huawei-functiongraph`

package/plugins/huaweicloud-core/skills/huaweicloud-troubleshooting/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Huawei Cloud Troubleshooting"
-  short_description: "Diagnose Huawei Cloud errors using evidence and read-only checks."
-  default_prompt: "Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error."
+interface:
+  display_name: "Huawei Cloud Troubleshooting"
+  short_description: "Diagnose Huawei Cloud errors using evidence and read-only checks."
+  default_prompt: "Use $huaweicloud-troubleshooting to diagnose this Huawei Cloud error."