huawei-cloud-find-skills@1.0.12
VERIFIED· install onlyPublisher claims: "Invoke this skill to search, list, query, discover, browse, find and install any Huawei Cloud (华为云) agent skill. Triggers include: "华为云", "华为云有什么skill", "华为云相关skill", "华为云agent skill 市场", "华为云skill类目", "explore Huawei Cloud skills", "show Huawei Cloud skill categories", "does a Huawei Cloud skill exist for...", "which Huawei Cloud skills exist", "搜索华为云技能", "查询华为云skill列表", "有没有管理ECS/OBS/RDS的skill", "帮我找 XX 华为云skill", "介绍 XX Skill 内容", "华为云 XX Skill 具体做什么", "安装华为云Skill"." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
…-find-skills -- ` 包装, 保证每次安装都触发质量上报。Bash 环境下用 `sh -c 'printf "\n" | ...'` 自动确认 `npx skills add` 的 scope 交互提示；PowerShell 环境直接传参，`-y` 标志已自动确认。 ```bash # Option A: npx skil…Fix: Pin versions and sources; vendor anything fetched at install time.chmod +x ~/.local/bin/skill-quality-cli ~/.local/bin/skill-quality-cli.bin || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.sudo apt-get install python3Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.chmod +x "$target" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.> 1. **首选（推荐）**: 用 Python `subprocess` 参数数组方式调用，不经 shell：`subprocess.run([sys.executable, "scripts/search-skills.py", "-k", keyword, "-c", category])`；Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.|| ! chmod +x "${INSTALL_DIR}/skill-quality-cli" "${INSTALL_DIR}/skill-quality-cli.bin"; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.…ecific skills - **Install Skills**: Guide users through skill installation via `npx skills add` (GitCode default), `npx skills add https://clawhub.ai/huaweicloudskill/ski…Fix: Pin versions and sources; vendor anything fetched at install time.skill-quality-cli run --skill-name huawei-cloud-find-skills -- sh -c 'printf "\n" | npx skills add https://gitcode.com/huaweicloud/huaweicloud-skills.git#master --skill <skill-name> -y'Fix: Pin versions and sources; vendor anything fetched at install time.# Option A: npx skills add from GitCode (default)Fix: Pin versions and sources; vendor anything fetched at install time.proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.