huawei-cloud-eip-list@1.0.5
VERIFIED· install onlyPublisher claims: "1. List Huawei Cloud Elastic IP (EIP) instances in a tenant region through KooCLI (hcloud EIP ListPublicips — read-only GET /v3/{project_id}/eip/publicips), with an automatic fallback to the official huaweicloudsdkeip v3 SDK when hcloud is not installed. 2. Four output modes: full-field table (default, every returned field including 名称/别名/ID/公网IP/带宽/状态/绑定资源), --json (raw response array), --names-only (compact EIP alias/public-IP list), and Markdown export (--markdown or -o/--output <path.md>). 3. Markdown export writes an archivable `.md` report in one query: title 「华为云 EIP 列表」, query region / generated time / record count, and a full fixed-header table (公网IP、EIP ID、别名、状态、类型、绑定实例类型/ID、 带宽名称/大小、计费方式、企业项目 ID、创建时间); missing fields render as `-`. Empty results still produce a `.md` marked 「无数据」 and exit 0. 4. Supports --id / --status / --public-ip filtering (all real server-side ListPublicips query parameters), region override, and automatic marker paging. 5. Explicit error hints for empty EIP lists (「当前区域无弹性公网IP(EIP)」), 403 / insufficient IAM permission (「无权限访问弹性公网IP(EIP)」), missing or invalid AK/SK credentials, missing project_id on the SDK fallback, and hcloud not installed. 6. Built-in write-intent guard: any mutating intent (create / delete / update / associate / disassociate / attach / detach / release / change) or any operation other than ListPublicips is rejected before execution — this skill is strictly read-only. 7. Triggers include: "list EIPs", "eip list", "弹性公网IP列表", "查询 EIP", "查询弹性公网IP", "EIP 实例列表", "elastic ip inventory", "list public ips", "华为云 EIP", "公网IP列表", "导出 EIP Markdown", "EIP 列表导出 md". 8. Offline unit tests (mocked hcloud subprocess) cover output modes, filters, marker paging, error scenarios, SDK fallback, Markdown export, and the write-intent guard." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 91/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.No other findings across 2,329 lines in 11 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.