Skills/ClawHub/huawei-cloud-vpc-list

huawei-cloud-vpc-list@1.0.5

VERIFIED

Publisher claims: "1. List Huawei Cloud Virtual Private Cloud (VPC) instances in a tenant region through KooCLI (hcloud VPC ListVpcs — read-only GET /v1/{project_id}/vpcs), with an automatic fallback to the official huaweicloudsdkvpc v2 SDK when hcloud is not installed. 2. Four output modes: full-field table (default, every returned field including id/name/cidr/status and the remaining VPC attributes), --json (raw response array), --names-only (compact VPC name list), and --format md (local Markdown report whose first column is VPC 名称). 3. `--format md` writes a fixed 8-column Markdown table (VPC 名称 / VPC ID / 区域 / 网段 / 状态 / 企业项目 ID / 描述 / 创建时间; missing field `-`; empty list = header-only table) to `--output`/`-o` (default `vpc_list_<region>_<timestamp>.md`), creates the parent directory, and writes via a temp file + atomic rename. Optional `--summary` appends the VPC count. Contract matches the dedicated VPC Markdown export skill (same fixed 8-column table; rendering kept independently). 4. Supports --id / --enterprise-project-id filtering (both real server-side ListVpcs query parameters; the CLI path emits the v3 array form `--id.1=<vpc-id>`, which KooCLI requires), region override, and automatic marker paging. 5. Explicit error hints for empty VPC lists (「当前区域无虚拟私有云(VPC)」), 403 / insufficient IAM permission (「无权限访问虚拟私有云(VPC)」), missing or invalid AK/SK credentials, missing project_id on the SDK fallback, and hcloud not installed. 6. Built-in write-intent guard: any mutating intent (create / delete / update / associate / disassociate / attach / detach / release / change) or any operation other than ListVpcs is rejected before execution — this skill is strictly read-only. The local `--output` / `--format` values are excluded from the guard (a report path like `vpc-delete-report.md` is not a VPC operation). 7. Triggers include: "list VPCs", "vpc list", "虚拟私有云列表", "查询 VPC", "查询虚拟私有云", "VPC 名称列表", "VPC 实例列表", "vpc inventory", "list vpcs", "华为云 VPC", "私有云列表". Dedicated Markdown-report intents are routed to the sibling export skill (see the division of labour below). 8. Offline unit tests (mocked hcloud subprocess) cover output modes, Markdown rendering/export, filters, marker paging, error scenarios, SDK fallback, and the write-intent guard." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher wlc-dev · joined 14 days agoInstalls 150Last detonated 2 h ago
$clawhub install huawei-cloud-vpc-list
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File permission modification commandscripts/ensure_cli.sh:93 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/list_vpc.py:292 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/install_cli.sh:80 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install_cli.sh:83 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/ensure_cli.sh:96 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈4,701 tok
1 file · 12 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

huawei-cloud-vpc-list@1.0.5 safety verdict: Verified 88/100 — KillerSkills