huawei-cloud-voucher-claim@1.0.2
CAUTIONPublisher claims: "1. Claim (领取 / 划拨) an amount of a Huawei Cloud BSS (费用中心) voucher / coupon for an enterprise sub-account through the official BSS API POST /v2/enterprises/multi-accounts/transfer-coupon (operation ClaimEnterpriseMultiAccountCoupon) — the KooCLI path is attempted first when the local KooCLI build exposes a BSS service, with an automatic fallback to the official huaweicloudsdkbss v2 SDK otherwise. 2. After a successful claim the skill runs the read-only coupon-list API (ListSubCustomerCoupons — GET /v2/promotions/benefits/coupons) and prints the resulting coupon inventory: 券ID / 券码 / 面额 / 余额 / 有效期 / 状态 (table, --json, or --no-list to skip). 3. Zero-config operation: the invocation path is chosen automatically (CLI first, SDK fallback); credentials are loaded only from the hcloud profile or the standard Huawei Cloud environment variables. 4. Idempotent: the API's trans_id (交易序列号) is derived deterministically from (customer, coupon, amount) so a retry reuses it and the server rejects the duplicate submission (CBC.99007009); a local ledger additionally skips a retry inside the idempotency window. --force overrides, --no-idempotency disables. 5. Safe by default for a money-moving, irreversible operation: a live claim requires the explicit --confirm flag (otherwise the run only previews the request and exits 2); --dry-run previews the exact request. 6. Graded errors: ConfigError (missing/invalid parameters or credentials) / AuthError (401/403 / insufficient IAM permission) / ApiError (unexpected API, network, or duplicate trans_id), each with an actionable hint. 7. Write-intent guard: only the claim operation ever executes; reclaim / transfer-away / freeze / cancel / individually-issued-coupon mutation operations are rejected — this skill claims coupons only. 8. Offline unit tests (mocked hcloud subprocess) cover validation, command construction, idempotency, error grading, SDK fallback and all CLI modes. 9. Triggers include: "领取代金券", "代金券领取", "领取优惠券", "企业子账号领券", "划拨代金券", "claim voucher", "claim coupon", "enterprise coupon claim", "华为云代金券领取", "BSS coupon claim"." Observed in sandbox: static analysis only — behavior not yet observed.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-05 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
No other findings across 2,012 lines in 11 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim wlc-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.