huaweicloud-devkit 1.0.3-dev.0 → 1.0.3-next.0

package/plugins/huaweicloud-core/skills/huawei-functiongraph/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-functiongraph
-description: "Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce)."
+description: 'Use when creating, deploying, or managing serverless functions on FunctionGraph. Covers triggers (APIG/OBS/timer/SMN), cold start, reserved concurrency. Triggers: FunctionGraph, serverless, function, Lambda, trigger. NOT for: CCE containers (use huawei-cce).'
 version: 1
 ---
 
@@ -20,16 +20,16 @@ Domain expertise for Huawei Cloud FunctionGraph. Covers function lifecycle, code
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Service name is `FunctionGraph` | NOT `FGS`. KooCLI 7.x uses the full service name |
-| CLI requires `project_id` | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...` |
-| Cold start 100ms-2s | Reserve concurrency for latency-sensitive workloads |
-| Max execution 900s | Use ECS/CCE for long-running tasks |
-| Env vars plaintext | Use DEW for secrets |
-| **ZIP upload is unreliable** | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
-| **DeleteFunction strip `:latest`** | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN). |
-| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`. |
+| Trap                                       | Why                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Service name is `FunctionGraph`            | NOT `FGS`. KooCLI 7.x uses the full service name                                                                                                                                                                                                                                                    |
+| CLI requires `project_id`                  | Get it: `hcloud IAM KeystoneListProjects` or extract from URN `urn:fss:<region>:<project_id>:...`                                                                                                                                                                                                   |
+| Cold start 100ms-2s                        | Reserve concurrency for latency-sensitive workloads                                                                                                                                                                                                                                                 |
+| Max execution 900s                         | Use ECS/CCE for long-running tasks                                                                                                                                                                                                                                                                  |
+| Env vars plaintext                         | Use DEW for secrets                                                                                                                                                                                                                                                                                 |
+| **ZIP upload is unreliable**               | `CreateFunction --code_type=zip --code_filename=xxx.zip` succeeds even with a nonexistent file — the function is created with empty code. Prefer `code_type=inline` for simple functions. If using zip, verify `code_size` > placeholder after creation and run `InvokeFunction` to confirm output. |
+| **DeleteFunction strip `:latest`**         | Passing `urn:fss:...:function:xxx:latest` causes FSS.0400. Strip `:latest` suffix (DeleteFunction only — UpdateApiV2 needs the full URN).                                                                                                                                                           |
+| **DeleteFunctionTrigger does NOT cascade** | Deleting a DEDICATEDGATEWAY trigger leaves the API in APIG. Manually clean up: `hcloud APIG DeleteApiV2 --instance_id=<id> --api_id=<api-id>`.                                                                                                                                                      |
 
 ## Prerequisites
 
@@ -42,13 +42,13 @@ hcloud FunctionGraph --help        # confirm service is available
 
 If you see `FSS.0403 Forbidden`, the user needs these permissions:
 
-| Operation | Required Permission |
-|-----------|---------------------|
+| Operation       | Required Permission                     |
+| --------------- | --------------------------------------- |
 | Create function | `functiongraph:function:createFunction` |
-| List functions | `functiongraph:function:list` |
+| List functions  | `functiongraph:function:list`           |
 | Delete function | `functiongraph:function:deleteFunction` |
-| Invoke function | `functiongraph:function:invoke` |
-| Create trigger | `functiongraph:trigger:*` |
+| Invoke function | `functiongraph:function:invoke`         |
+| Create trigger  | `functiongraph:trigger:*`               |
 
 Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
@@ -56,18 +56,19 @@ Grant via IAM console (`FunctionGraph FullAccess` role) or ask project admin.
 
 Always discover parameters with `--help` before executing. These are the correct operation names:
 
-| Task | Operation | Gotchas |
-|------|-----------|---------|
-| List functions | `ListFunctions` | |
-| Show function | `ShowFunctionConfig` | |
-| Create function | `CreateFunction` | references/create-function.md |
-| Delete function | `DeleteFunction` | Strip `:latest` from URN |
-| Invoke function | `InvokeFunction` | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
-| Create trigger | `CreateFunctionTrigger` | references/triggers.md |
-| List triggers | `ListFunctionTriggers` | |
-| Delete trigger | `DeleteFunctionTrigger` | |
+| Task            | Operation               | Gotchas                                                                                                                            |
+| --------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| List functions  | `ListFunctions`         |                                                                                                                                    |
+| Show function   | `ShowFunctionConfig`    |                                                                                                                                    |
+| Create function | `CreateFunction`        | references/create-function.md                                                                                                      |
+| Delete function | `DeleteFunction`        | Strip `:latest` from URN                                                                                                           |
+| Invoke function | `InvokeFunction`        | Requires body param (`--name=<value>` becomes event body). Use `--x_cff_request_version=v0` for raw output, `v1` for APIG-wrapped. |
+| Create trigger  | `CreateFunctionTrigger` | references/triggers.md                                                                                                             |
+| List triggers   | `ListFunctionTriggers`  |                                                                                                                                    |
+| Delete trigger  | `DeleteFunctionTrigger` |                                                                                                                                    |
 
 Discover exact parameters:
+
 ```bash
 hcloud FunctionGraph CreateFunction --help
 hcloud FunctionGraph CreateFunctionTrigger --help
@@ -83,19 +84,19 @@ See `references/deploy-workflow.md` for a step-by-step example with code templat
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| `不支持的服务名称:FGS` | Use `FunctionGraph`, not `FGS` |
-| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger` |
-| `FSS.0403` / Forbidden | Missing IAM permissions — see IAM Permissions above |
-| `缺少必填参数:{*}` on Invoke | Add body param: `--name=<value>` |
-| APIG/EOM trigger error | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY` |
-| `event_data` parse error | Use dotted format: `--event_data.key=value`, NOT JSON string |
-| FSS.1078 / code upload fails | `--code_filename` is filename-only, no path. `cd` to zip directory first |
-| DeleteFunction with `:latest` | Strip `:latest` version suffix from URN |
-| Code too large | Inline limit 10KB — use `zip`/`obs` code type |
-| Cold start slow | Set reserved instances for critical functions |
-| Auth failure | Run `npx huaweicloud-devkit auth init` |
+| Error                             | Root Cause -> Fix                                                        |
+| --------------------------------- | ------------------------------------------------------------------------ |
+| `不支持的服务名称:FGS`            | Use `FunctionGraph`, not `FGS`                                           |
+| `不支持的operation:CreateTrigger` | Use `CreateFunctionTrigger`                                              |
+| `FSS.0403` / Forbidden            | Missing IAM permissions — see IAM Permissions above                      |
+| `缺少必填参数:{*}` on Invoke      | Add body param: `--name=<value>`                                         |
+| APIG/EOM trigger error            | `trigger_type_code=APIG` deprecated — use `DEDICATEDGATEWAY`             |
+| `event_data` parse error          | Use dotted format: `--event_data.key=value`, NOT JSON string             |
+| FSS.1078 / code upload fails      | `--code_filename` is filename-only, no path. `cd` to zip directory first |
+| DeleteFunction with `:latest`     | Strip `:latest` version suffix from URN                                  |
+| Code too large                    | Inline limit 10KB — use `zip`/`obs` code type                            |
+| Cold start slow                   | Set reserved instances for critical functions                            |
+| Auth failure                      | Run `npx huaweicloud-devkit auth init`                                   |
 
 ## Security Considerations
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/apig-event-format.md

@@ -22,6 +22,7 @@ When APIG calls FunctionGraph via DEDICATEDGATEWAY trigger, the event structure
 `event["body"]` is Base64 encoded. You MUST decode it:
 
 **Python handler template:**
+
 ```python
 import json, base64
 
@@ -38,18 +39,19 @@ def handler(event, context):
 ```
 
 **Node.js handler template:**
+
 ```js
 exports.handler = async (event, context) => {
-    let body = event.body || "";
-    if (event.isBase64Encoded) {
-        body = Buffer.from(body, "base64").toString("utf8");
-    }
-    const data = body ? JSON.parse(body) : {};
-    return {
-        statusCode: 200,
-        body: JSON.stringify({ message: "ok", received: data }),
-        headers: { "Content-Type": "application/json" }
-    };
+  let body = event.body || '';
+  if (event.isBase64Encoded) {
+    body = Buffer.from(body, 'base64').toString('utf8');
+  }
+  const data = body ? JSON.parse(body) : {};
+  return {
+    statusCode: 200,
+    body: JSON.stringify({ message: 'ok', received: data }),
+    headers: { 'Content-Type': 'application/json' },
+  };
 };
 ```
 

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/create-function.md

@@ -2,14 +2,14 @@
 
 ## Runtime Options
 
-| Runtime | Handler Format | Example |
-|---------|---------------|---------|
-| Python3.9 | `index.handler` | `def handler(event, context): return {"statusCode": 200}` |
-| Python3.10 | `index.handler` | Same as 3.9 |
-| Node.js 18 | `index.handler` | `exports.handler = async (event, context) => ({statusCode: 200})` |
-| Java 8/11/17 | `com.example.Handler::handleRequest` | Java class method |
-| Go 1.x | `handler` | Go function name |
-| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method |
+| Runtime        | Handler Format                             | Example                                                           |
+| -------------- | ------------------------------------------ | ----------------------------------------------------------------- |
+| Python3.9      | `index.handler`                            | `def handler(event, context): return {"statusCode": 200}`         |
+| Python3.10     | `index.handler`                            | Same as 3.9                                                       |
+| Node.js 18     | `index.handler`                            | `exports.handler = async (event, context) => ({statusCode: 200})` |
+| Java 8/11/17   | `com.example.Handler::handleRequest`       | Java class method                                                 |
+| Go 1.x         | `handler`                                  | Go function name                                                  |
+| C# (.NET Core) | `CsharpDemo::CsharpDemo.Function::Handler` | Namespace.Class::Method                                           |
 
 ## Create Function (inline)
 
@@ -26,13 +26,13 @@ hcloud FunctionGraph CreateFunction \
   --cli-region=<region>
 ```
 
-| Param | Required | Range/Default |
-|-------|----------|---------------|
-| `--func_name` | Yes | 1-60 chars |
-| `--runtime` | Yes | See runtime options above |
-| `--handler` | Yes | Per runtime |
-| `--memory_size` | No | 128-4096 MB, default 128 |
-| `--timeout` | No | 1-900s, default 3 |
+| Param           | Required | Range/Default             |
+| --------------- | -------- | ------------------------- |
+| `--func_name`   | Yes      | 1-60 chars                |
+| `--runtime`     | Yes      | See runtime options above |
+| `--handler`     | Yes      | Per runtime               |
+| `--memory_size` | No       | 128-4096 MB, default 128  |
+| `--timeout`     | No       | 1-900s, default 3         |
 
 ## ZIP Upload Warning
 
@@ -49,11 +49,11 @@ Grant `FunctionGraph FullAccess` role or custom policy.
 
 ## Error Codes
 
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| FSS.0400 | `:latest` suffix on URN. Strip it |
-| FSS.1417 | Missing DEDICATEDGATEWAY params |
-| FSS.0403 | Insufficient IAM permission |
+| Error    | Root Cause -> Fix                                                                                                                           |
+| -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| FSS.0400 | `:latest` suffix on URN. Strip it                                                                                                           |
+| FSS.1417 | Missing DEDICATEDGATEWAY params                                                                                                             |
+| FSS.0403 | Insufficient IAM permission                                                                                                                 |
 | FSS.1020 | Missing `--app_xrole` when binding VPC. Create IAM agency with `trust_domain_name=functiongraph`. See `huawei-iam` skill → Agencies section |
 
 ## VPC + Agency Configuration
@@ -68,4 +68,5 @@ hcloud IAM GrantRoleToAgency --agency_name=<name> --role_id=<role-id>
 # 3. Use in CreateFunction
 hcloud FunctionGraph CreateFunction --func_vpc.vpc_id=<vpc> --func_vpc.subnet_id=<subnet> --app_xrole=<name> ...
 ```
+
 | QuotaExceeded | Max 10 functions per project per region |

package/plugins/huaweicloud-core/skills/huawei-functiongraph/references/triggers.md

@@ -16,12 +16,12 @@ KooCLI uses **dotted key-value format**, NOT JSON strings:
 
 ## Trigger Types
 
-| Type | `--trigger_type_code` | Notes |
-|------|----------------------|-------|
-| APIG Dedicated | `DEDICATEDGATEWAY` | Use this, not `APIG` (deprecated). Requires APIG instance. |
-| Timer / Cron | `TIMER` | Simplest trigger for testing. No APIG dependency. |
-| OBS | `OBS` | Event when objects created/deleted in bucket |
-| SMN | `SMN` | Message notification trigger |
+| Type           | `--trigger_type_code` | Notes                                                      |
+| -------------- | --------------------- | ---------------------------------------------------------- |
+| APIG Dedicated | `DEDICATEDGATEWAY`    | Use this, not `APIG` (deprecated). Requires APIG instance. |
+| Timer / Cron   | `TIMER`               | Simplest trigger for testing. No APIG dependency.          |
+| OBS            | `OBS`                 | Event when objects created/deleted in bucket               |
+| SMN            | `SMN`                 | Message notification trigger                               |
 
 ## TIMER Trigger (Simple Testing)
 
@@ -46,22 +46,22 @@ hcloud FunctionGraph CreateFunctionTrigger \
 
 These are labeled optional by `--help` but are **required** for DEDICATEDGATEWAY:
 
-| Param | Note |
-|-------|------|
-| `--event_data.protocol` | `HTTPS` or `HTTP` or `BOTH` |
-| `--event_data.sl_domain` | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
-| `--event_data.env_name` | API environment name (`RELEASE`) |
-| `--event_data.env_id` | API environment ID |
-| `--event_data.instance_id` | APIG dedicated instance ID |
-| `--event_data.group_id` | API group ID |
-| `--event_data.name` | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead. |
+| Param                      | Note                                                                         |
+| -------------------------- | ---------------------------------------------------------------------------- |
+| `--event_data.protocol`    | `HTTPS` or `HTTP` or `BOTH`                                                  |
+| `--event_data.sl_domain`   | Subdomain from APIG instance (e.g. `xxxx.apic.<region>.huaweicloudapis.com`) |
+| `--event_data.env_name`    | API environment name (`RELEASE`)                                             |
+| `--event_data.env_id`      | API environment ID                                                           |
+| `--event_data.instance_id` | APIG dedicated instance ID                                                   |
+| `--event_data.group_id`    | API group ID                                                                 |
+| `--event_data.name`        | API name — **hyphens (`-`) are DISALLOWED**. Use underscores (`_`) instead.  |
 
 ### Error Mapping
 
-| Error | Root Cause → Fix |
-|-------|-----------------|
-| FSS.1417 | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
-| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only. |
+| Error               | Root Cause → Fix                                                                                                 |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| FSS.1417            | Missing `instance_id`, `group_id`, `protocol`, `env_name`, or `env_id`. These are labeled optional but REQUIRED. |
+| API name regex fail | Rename API — remove hyphens (`-`), use `[a-zA-Z0-9_]+` only.                                                     |
 
 ### Example
 

package/plugins/huaweicloud-core/skills/huawei-gaussdb/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-gaussdb
-description: "Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds)."
+description: 'Use when creating or managing GaussDB distributed database on Huawei Cloud. Covers GaussDB(for MySQL), GaussDB(for openGauss), sharding, HTAP. Triggers: GaussDB, distributed database, sharding, openGauss, HTAP. NOT for: single RDS (use huawei-rds).'
 version: 1
 ---
 
@@ -16,34 +16,34 @@ Domain expertise for GaussDB. Covers instance lifecycle, databases, backups, con
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| Shard key permanent | Once set, shard key cannot be changed |
-| Minimum nodes | Distributed GaussDB requires at least 3 nodes for production |
-| Engine version pinned | MySQL-compatible vs openGauss are separate products |
+| Trap                  | Why                                                          |
+| --------------------- | ------------------------------------------------------------ |
+| Shard key permanent   | Once set, shard key cannot be changed                        |
+| Minimum nodes         | Distributed GaussDB requires at least 3 nodes for production |
+| Engine version pinned | MySQL-compatible vs openGauss are separate products          |
 
 ## Common Workflows
 
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Show instance | `ShowInstance --cli-region=<r> --project_id=<p>` |
-| List flavors | `ListFlavors --cli-region=<r> --project_id=<p>` |
-| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
-| Create backup | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
-| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
-| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
-| Manage database | `AddDatabasePermission --cli-region=<r> --project_id=<p>` |
+| Task              | Operation                                                  |
+| ----------------- | ---------------------------------------------------------- |
+| List instances    | `ListInstances --cli-region=<r> --project_id=<p>`          |
+| Show instance     | `ShowInstance --cli-region=<r> --project_id=<p>`           |
+| List flavors      | `ListFlavors --cli-region=<r> --project_id=<p>`            |
+| Create instance   | `CreateInstance --cli-region=<r> --project_id=<p>`         |
+| Delete instance   | `DeleteInstance --cli-region=<r> --project_id=<p>`         |
+| Create backup     | `CreateGaussMySqlBackup --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>`        |
+| Add shard         | `AddShardingNode --cli-region=<r> --project_id=<p>`        |
+| Manage database   | `AddDatabasePermission --cli-region=<r> --project_id=<p>`  |
 
 Discover exact parameters with `--help` before executing any command.
 
 ## Troubleshooting
 
-| Error | Fix |
-|-------|-----|
+| Error                   | Fix                                               |
+| ----------------------- | ------------------------------------------------- |
 | Instance creation fails | Check VPC/subnet availability and flavor capacity |
-| Connection refused | SG missing database port |
+| Connection refused      | SG missing database port                          |
 
 ## Security
 

package/plugins/huaweicloud-core/skills/huawei-getting-started/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-getting-started
-description: "Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.)."
+description: 'Use when starting fresh with Huawei Cloud or KooCLI, installing prerequisites, setting up authentication, or exploring what is possible. Triggers: getting started, first time, setup, install, explore, quickstart, beginner, tutorial. NOT for: specific service operations (use huawei-ecs, huawei-obs, etc.).'
 version: 1
 ---
 
@@ -10,13 +10,14 @@ version: 1
 
 ## KooCLI Installation
 
-| OS | Command |
-|----|---------|
-| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download |
-| Linux | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
-| macOS | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| OS                   | Command                                                                                                               |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| Windows (PowerShell) | See https://support.huaweicloud.com/qs-hcli/hcli_02_003.html for MSI download                                         |
+| Linux                | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
+| macOS                | curl -LO "https://hwcloudcli.obs.cn-north-1.myhuaweicloud.com/cli/latest/hcloud_install.sh" && bash hcloud_install.sh |
 
 ## First-Time Setup
+
 1. **Install KooCLI** using command above
 2. **Accept privacy policy** (first run only): KooCLI requires one-time privacy agreement. Run `hcloud version` to read the agreement, then respond `y` to accept. Do not pipe `echo "y" |` — you must review the terms first.
 3. **Configure credentials (unified)**: `npx huaweicloud-devkit auth init` — prefer this over `hcloud configure init`, which only covers KooCLI.
@@ -38,28 +39,31 @@ hcloud configure list
 ```
 
 ## Critical Warnings
-| Trap | Why |
-|------|-----|
-| AK/SK must be kept secret | Never commit to git or share |
-| Default region applies to all commands | Override with --cli-region= per command |
-| Some services region-specific | Not all services available in all regions |
-| Privacy policy blocks first run | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
+
+| Trap                                   | Why                                                                                           |
+| -------------------------------------- | --------------------------------------------------------------------------------------------- |
+| AK/SK must be kept secret              | Never commit to git or share                                                                  |
+| Default region applies to all commands | Override with --cli-region= per command                                                       |
+| Some services region-specific          | Not all services available in all regions                                                     |
+| Privacy policy blocks first run        | Run `hcloud version` to read and accept the agreement. Review the terms before responding `y` |
 
 ## What Can I Do? (Quick Index)
-| Goal | Skill |
-|------|-------|
-| Create a VM | huawei-ecs |
-| Store files | huawei-obs |
+
+| Goal              | Skill                       |
+| ----------------- | --------------------------- |
+| Create a VM       | huawei-ecs                  |
+| Store files       | huawei-obs                  |
 | Set up a database | huawei-rds / huawei-gaussdb |
-| Create a network | huawei-vpc |
-| Manage access | huawei-iam |
-| Deploy an app | huawei-deployment |
-| Run containers | huawei-cce |
-| Build an API | huawei-apig |
-| Run serverless | huawei-functiongraph |
-| Monitor resources | huawei-cloud-eye |
+| Create a network  | huawei-vpc                  |
+| Manage access     | huawei-iam                  |
+| Deploy an app     | huawei-deployment           |
+| Run containers    | huawei-cce                  |
+| Build an API      | huawei-apig                 |
+| Run serverless    | huawei-functiongraph        |
+| Monitor resources | huawei-cloud-eye            |
 
 ## Pro Tips
+
 - Use `hcloud <Service> --help` to discover operations (see huaweicloud-capability-discovery)
 - Prepend `hcloud configure set --cli-region=<r>` to avoid per-command region flags
 - Pipe sensitive output through IAM with `--cli-output-format=json`

package/plugins/huaweicloud-core/skills/huawei-iam/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: huawei-iam
-description: "Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew)."
+description: 'Use when managing IAM users, groups, roles, policies, agencies, projects, or access keys on Huawei Cloud. Covers IAM policy structure, least-privilege design, temporary credentials (STS), OneAccess integration, and security best practices. Triggers on: IAM, permission, policy, role, user, group, AK/SK, access key, agency, project, authorization. NOT for: DEW secret management (use huawei-dew).'
 version: 1
 ---
 
@@ -16,13 +16,13 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
 
 ## Critical Warnings
 
-| Trap | Why |
-|------|-----|
-| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO |
-| NEVER create long-term AK/SK | Use temporary STS tokens via agencies |
-| Wildcard policies dangerous | Effect:Allow + Resource:* = full access. Always scope resources |
-| Agency trust is powerful | Agencies let services assume roles. Always add conditions |
-| Root account must have MFA | Root AK/SK is all-powerful. Enable MFA immediately |
+| Trap                              | Why                                                             |
+| --------------------------------- | --------------------------------------------------------------- |
+| NEVER create IAM users for humans | Use OneAccess (IAM Identity Center) or federated SSO            |
+| NEVER create long-term AK/SK      | Use temporary STS tokens via agencies                           |
+| Wildcard policies dangerous       | Effect:Allow + Resource:* = full access. Always scope resources |
+| Agency trust is powerful          | Agencies let services assume roles. Always add conditions       |
+| Root account must have MFA        | Root AK/SK is all-powerful. Enable MFA immediately              |
 
 ## Policy Structure
 
@@ -42,33 +42,33 @@ Domain expertise for Huawei Cloud Identity and Access Management (IAM). Covers u
 
 ## Common Workflows
 
-| Task | Command | Steps |
-|------|---------|-------|
-| List users | hcloud IAM ListUsers | references/iam-ops.md |
-| Create group | hcloud IAM CreateGroup --group.name=<name> | references/iam-ops.md |
-| Create custom policy | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json> | references/policy-examples.md |
-| Create agency | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md |
-| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600 | references/sts.md |
-| Attach policy | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id> | references/iam-ops.md |
+| Task                     | Command                                                                                        | Steps                         |
+| ------------------------ | ---------------------------------------------------------------------------------------------- | ----------------------------- |
+| List users               | hcloud IAM ListUsers                                                                           | references/iam-ops.md         |
+| Create group             | hcloud IAM CreateGroup --group.name=<name>                                                     | references/iam-ops.md         |
+| Create custom policy     | hcloud IAM CreateCustomPolicy --policy.name=<n> --policy.document=<json>                       | references/policy-examples.md |
+| Create agency            | hcloud IAM CreateAgency --agency.name=<n> --agency.domain_id=<id> --agency.trust_policy=<json> | references/agency.md          |
+| Get temporary credential | hcloud STS GetTemporaryCredential --agency_name=<n> --domain_id=<id> --duration_seconds=3600   | references/sts.md             |
+| Attach policy            | hcloud IAM AttachGroupPolicy --group_id=<id> --policy_id=<id>                                  | references/iam-ops.md         |
 
 ## Policy Examples (Least Privilege)
 
-| Role | Actions | Resource |
-|------|---------|----------|
-| ECS Reader | ecs:List*, ecs:Get*, ecs:Describe* | * |
-| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List* | obs:*:*:bucket:my-bucket |
-| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:* |
+| Role                | Actions                                                 | Resource                 |
+| ------------------- | ------------------------------------------------------- | ------------------------ |
+| ECS Reader          | ecs:List*, ecs:Get*, ecs:Describe*                      | *                        |
+| OBS Bucket Operator | obs:Get*, obs:Put*, obs:Delete*, obs:List*              | obs:_:_:bucket:my-bucket |
+| RDS Backup Operator | rds:CreateBackup, rds:RestoreFromBackup, rds:ListBackup | rds:*                    |
 
 > See `references/policy-examples.md` for complete policy JSON templates with conditions.
 
 ## Troubleshooting
 
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied | Missing IAM permission -> Check policy action and resource scope |
-| AuthFailure | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
-| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition |
-| Quota exceeded | IAM user/group/policy limit -> Request quota increase |
+| Error               | Root Cause -> Fix                                                      |
+| ------------------- | ---------------------------------------------------------------------- |
+| AccessDenied        | Missing IAM permission -> Check policy action and resource scope       |
+| AuthFailure         | Expired AK/SK or wrong project -> Renew credentials / Check project ID |
+| Agency trust failed | Missing trust policy condition -> Add g:SourceAccount condition        |
+| Quota exceeded      | IAM user/group/policy limit -> Request quota increase                  |
 
 ## Security Considerations