huawei-cloud-codearts-list@1.0.4
CAUTIONPublisher claims: "1. List Huawei Cloud CodeArts resources (read-only) in a tenant region/project through KooCLI, routing by --resource to the correct CodeArts list API: projects (ProjectMan ListProjectsV4, GET /v4/projects), repos (CodeArtsRepo ListProjectRepositories, GET /v4/projects/{project_id}/repositories), pipelines (CodeArtsPipeline ListPipelines, POST /v5/{project_id}/api/pipelines/list), deploy-tasks (CodeArtsDeploy ListDeployTasks, GET /v2/{project_id}/tasks/list). Automatic fallback to the matching official Python SDK (huaweicloudsdkprojectman / huaweicloudsdkcodeartsrepo / huaweicloudsdkcodeartspipeline / huaweicloudsdkcodeartsdeploy) when hcloud is not installed. 2. Three output modes: full-field table (default, every returned field including 名称/ID/状态/项目/可见性), --json (raw response items), and --names-only (compact name + ID inventory). 3. Project-scoped resources (repos / pipelines / deploy-tasks) take --project-id; when omitted the skill auto-resolves it from the project list and proceeds only if exactly one project exists. 4. Supports --name filtering (server-side where the API exposes it, client-side otherwise), client-side --status filtering, --region override (default cn-north-4) and automatic paging (offset/limit or page/size). 5. Explicit error hints for empty lists (「无 CodeArts 资源」), 403 / insufficient IAM permission (「请检查 IAM 权限」), missing or invalid AK/SK credentials, and hcloud not installed. 6. Built-in write-intent guard: any mutating intent (create / delete / update / run / start / stop / merge / batch ...) or any operation other than the four read-only List operations is rejected before execution — strictly read-only. 7. Offline unit tests (mocked hcloud subprocess) cover routing, output modes, filters, paging, project auto-resolution, error scenarios, SDK fallback, and the write-intent guard. 8. Triggers include: "list CodeArts projects", "CodeArts 项目列表", "查询CodeArts项目", "代码托管仓库列表", "CodeArts Repo 仓库列表", "流水线列表", "CodeArts Pipeline 列表", "部署任务列表", "CodeArts Deploy 任务", "CodeArts inventory", "DevOps 资产盘点", "华为云CodeArts列表"." Observed in sandbox: static analysis only — behavior not yet observed.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-05 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
No other findings across 2,192 lines in 9 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim wlc-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.