huawei-cloud-skill-audit

Huawei Cloud Skill Audit

Three-check security pipeline for auditing Huawei Cloud skills — security gate.

Step 0: Install skill-quality-cli (idempotent, skip if already installed)

First set AUDIT_DIR to the absolute path of this skill's installation directory (export AUDIT_DIR=/path/to/huawei-cloud-skill-audit, example: $HOME/.local/share/huawei-cloud-skill-audit), and use it consistently for all subsequent commands. It is forbidden to execute this skill's scripts using relative paths inside the audited directory (to prevent hijacking by malicious scripts with the same name inside the directory, see Core Commands security requirements).

export AUDIT_DIR=/path/to/huawei-cloud-skill-audit   # 替换为实际安装目录
bash "$AUDIT_DIR/scripts/ensure_cli.sh"

⚠️ Mandatory requirement: any hcloud command of this skill must be wrapped with skill-quality-cli run --skill-name huawei-cloud-skill-audit -- , bare calls to hcloud are forbidden. (Mandatory: bare hcloud calls are strictly forbidden.)

Installation behavior description:

Already installed and available → silently skip; not installed → download the official package from Huawei Cloud OBS (HTTPS) (wrapper + ELF + Python fallback, low-GLIBC compatible) and install it to ~/.local/bin/。

Offline/installation failed → print to stderr 警告: then skip, without blocking the business flow (but wrapped commands will command not found, formal scenarios must ensure successful installation).

For debugging/offline scenarios, the bare command python3 "$AUDIT_DIR/scripts/skill_audit.py" ...may be used (see Core Commands security requirements and unified description).

Overview

Scan a single Huawei Cloud skill directory or a folder of skills, run three security gates, and generate a structured report with issue details and fix strategies.

Three checks:

#	Tool	Check Content	Implementation
1	skillspector	AI skill security scanner: 52 rules / 609 patterns across 18 categories (prompt injection, data exfiltration, privilege escalation, supply chain, behavioral AST, taint tracking, MCP analysis, YARA)	Built-in (pure Python, 52 rules + AST analysis)
2	gitleaks	Credential leak scan: 43 rules detecting hardcoded API keys, passwords, private keys, tokens	Built-in (pure Python, 43 rules + Shannon entropy)
3	runtime_security	CWE high-risk runtime patterns: 36 rules (command injection, deserialization, credential theft, sandbox escape, persistence, destructive ops, mining) + 3 skill-quality rules (Q001-Q003)	Built-in (pure Python, level-independent, all rules always run)

The rule counts (52/609, 43, 36+3) are subject to scripts/checks/*rules.json ; after adding or removing rules, please update this table accordingly.

Dependency: Quality telemetry is collected automatically via skill-quality-cli (installed by scripts/ensure_cli.sh if absent; for the specific commands to install/upgrade/disable telemetry, see references/cli-installation-guide.md).

Prerequisites

Python 3.10+ — for the built-in skillspector and gitleaks checks
Node.js + npx — Optional; only needed for manual markdownlint-cli2 --fix during remediation
hcloud CLI — For Huawei Cloud service verification (optional, used in verification only)
Huawei Cloud AK/SK — Not required for audit itself, but needed if verifying skill functionality after audit

Built-in / external binary description:

Built-in by default: skillspector and gitleaks are both pure Python implementations, requiring no external binary or pip installation.
External paths take effect only when explicitly specified: pass --skillspector/--gitleaks <path> to use an external binary.
PATH auto-discovery is disabled(2026-09-23, fail-closed): no longer probing from PATH, to avoid a malicious binary with the same name injected into PATH silently taking over the audit.
External binaries are not signature/hash verified: please ensure their source is trusted (no binary with the same name in PATH, download source controlled).
Default behavior: when --skillspector/--gitleaks is not passed, the built-in pure Python implementation is always used, regardless of scan level.

To skip fallback auto-install of external binaries, use --no-install flag.

Workflow

Input (skill path or folder)
    │
    ├── Discover Skills ──── Find SKILL.md in target or subdirectories
    │
    ├── Run Three Checks ────
    │   1. skillspector → AI security scan (52 rules, 609 patterns)
    │   2. gitleaks → Credential leak detection
    │   3. runtime_security → CWE high-risk runtime patterns (36 + 3 rules)
    │
    ├── Build Report ────
    │   Section 1: Scanned Skills
    │   Section 2: Issue Summary (by severity)
    │   Section 3: Issue Details (per-issue)
    │   Section 4: Fix Strategies (per rule/category)
    │
    └── Gate Verdict ──── PASS or FAIL

Scan Levels

Level	Analyzers	Speed	Use Case
`critical`	"critical" severity rules only (P5 harmful content)	Fast	Strictest gate
`high`	"critical" + "error" severity rules + AST (exec/eval/os.system/deserialization)	Fast	Block high-risk issues
`quick`	Pattern matching only (all static regex rules)	Fast	Quick pre-commit check
`standard`	All static analyzers (on top of high, enable WARNING/INFO level AST + taint tracking)	Medium	CI/CD gate
`deep`	Standard + MCP analysis (least privilege, tool poisoning, rug pull)	Slower	Pre-release full audit

⚠️ Terminology distinction: the scan level name (critical/high/quick/standard/deep, backticks) and the severity value in the rule JSON ("critical"/"high"/"medium"/"low", quotes) aretwo sets of values — the level determines which analyzers are enabled and which severity levels are filtered to; severity is a property of an individual rule. Same name does not mean the same concept: for example, the critical level filters out "critical" level findings, the high level filters out "critical"+"error" level findings.

Severity filtering applies only to SkillSpector (rule selection per scan level). gitleaks bundles only "critical"/"high" severity rules, so all of them run at every scan level. runtime_security is level-independent: all 39 rules (36 CWE + Q001-Q003) always run, and its CRITICAL findings always block the gate.

AST analysis is performed at high/standard/deep(high is the default level and must include AST, otherwise execution-class detections such as eval/exec/pickle.loads can be directly bypassed). The high level floor filter retains CRITICAL/ERROR level findings (critical/high are severity values in the rule JSON, internally mapped to CRITICAL/ERROR), therefore the default level blocks: AST1/2/5/9/10 (exec/eval/os.system/getattr reflection/deserialization, all ERROR level); WARNING level (AST3/4/6/7: compile/subprocess/dynamic import, etc.) is visible only at standard/deep. .py parsing failures are no longer silent — an ERROR level AST-SYNTAX finding is produced and blocks the gate (fail-closed, preventing malicious code corruption from evading AST).

KooCLI Command Format Standard

This skill audits skill directories locally and does not directly invoke hcloud CLI commands. When verifying a skill's functionality after audit, the standard KooCLI format applies — the line below is an illustrative template, not a runnable command:

bash "$AUDIT_DIR/scripts/hcloud-run.sh" <Service> <Operation> --cli-region=<region> [--key=value ...]   # 强制入口：一切 hcloud 经 hcloud-run.sh 包装执行（hcloud-run.sh 内部自动经 skill-quality-cli run 包裹上报, 见 Step 0 强制要求）; hcloud 场景下用户只需调用 hcloud-run.sh, 不要手工再包一层 skill-quality-cli run

Core Commands

⚠️ Security requirement (must be complied with): all commands must be via absolute path Reference this skill's scripts/skill_audit.py. The audited skill directory isuntrusted input — it may contain pre-planted malicious scripts/skill_audit.py, and if a relative path is executed within that directory python3 scripts/skill_audit.py, the audit will execute the attacker's code (RCE). Before executing, first set AUDIT_DIR to the absolute path of this skill's (huawei-cloud-skill-audit) installation directory: export AUDIT_DIR=/path/to/huawei-cloud-skill-audit(example: $HOME/.local/share/huawei-cloud-skill-audit). After that, uniformly use python3 "$AUDIT_DIR/scripts/skill_audit.py" ..., and you can use --target . to point to your location/any audited directory.

Unified description: each scenario provides two commands — ① the wrapped command (skill-quality-cli run --skill-name huawei-cloud-skill-audit -- ...): it must be used for formal use (quality reporting); ② the bare command (python3 "$AUDIT_DIR/scripts/skill_audit.py" ...): the equivalent direct execution only for debugging/offline scenarios; do not use the bare command for formal use.

Scan a single skill

# 先按上述安全要求设置 AUDIT_DIR, 然后在任意目录执行(--target . 指向被审计目录)
skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .

Scan a folder of skills

# --target 指向包含多个技能的父目录
skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target ..

Scan with specific level

skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .. --scan-level quick

Selective check execution

skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .. --checks skillspector
skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .. --skip-checks gitleaks

Run with custom tool paths

Custom binary locations can be overridden with --skillspector, --gitleaks and --node-bin (see Parameter Confirmation; default auto-install location is ~/.local/bin/):

skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .. --skillspector /path/to/skillspector --gitleaks /path/to/gitleaks --node-bin /path/to/node
# 等效直接执行（⚠️ 仅调试/离线场景, 正式使用请经 skill-quality-cli run 包裹以保证质量上报）
python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .. --skillspector /path/to/skillspector --gitleaks /path/to/gitleaks --node-bin /path/to/node

Available --scan-level values: high (default), critical, quick, standard, deep. Available --checks: skillspector, gitleaks, runtime_security. Use --skip-checks to exclude specific checks.

Parameter Confirmation

Parameter	Required	Description	Example
`--target`	Yes	Single skill dir or parent folder of skills	`/path/to/skill-dir`
`--output-dir`	No	Report output directory (default: parent of target)	`--output-dir ./reports`
`--scan-level`	No	Scan depth: high/critical/quick/standard/deep (default: high)	`--scan-level deep`
`--checks`	No	Comma-separated checks to run (default: all); valid values are only `skillspector`, `gitleaks`, `runtime_security`. Mutually exclusive with `--skip-checks`	`--checks skillspector`
`--skillspector`	No	SkillSpector binary path override	`--skillspector ~/.local/bin/skillspector`
`--gitleaks`	No	gitleaks binary path override (auto-installs to ~/.local/bin when missing)	`--gitleaks ~/.local/bin/gitleaks`
`--skip-checks`	No	Comma-separated checks to skip; mutually exclusive with `--checks`	`--skip-checks gitleaks`
`--no-install`	No	Skip auto-install of tools	`--no-install`

Report Structure

Report is saved as skill-gate-report-<timestamp>.txt in the parent directory of the scanned path.

Input	Report saved to
`/repo/skills/huawei-cloud-ecs-manage`	`/repo/skills/skill-gate-report-<timestamp>.txt`
`/repo/skills`	`/repo/skill-gate-report-<timestamp>.txt`

Four sections:

Scanned Skills — list of all skills found
Issue Summary — count by severity (CRITICAL/ERROR/WARNING) with rule breakdown (INFO excluded)
Issue Details — per-issue: skill name, rule, line number, snippet, message
Fix Strategies — actionable remediation for each unique rule/category

Fix Strategies Reference

skillspector

Rule	Fix
P1-P8 (Prompt Injection / System Prompt Leakage)	Do not embed user-controllable input in system prompts; use template variables with explicit escaping
E1-E5 (Data Exfiltration)	Remove external URLs; use env vars for API endpoints; restrict network access in tool definitions
PE1-PE5 (Privilege Escalation)	Avoid sudo/root commands; use capability-based permissions; do not disable security controls
AST (Behavioral AST: AST1-AST7/9/10)	Replace exec()/eval() with safer alternatives; use importlib with allowlists
YR1-YR4 (YARA)	Remove reverse shell/webshell patterns; move server functionality to separate controlled service
SC1/SC2/SC3/SC7 (Supply Chain)	Pin dependency versions with hashes; update vulnerable dependencies
EA1-EA4 (Excessive Agency)	Scope tool permissions to the minimum required for the task
MP1-MP3, OH1-OH3 (Memory Poisoning / Output Handling)	Validate memory writes and tool output before use
RA1-RA2, AS1-AS3 (Rogue Agent / Agent Snooping)	Restrict agent delegation and session data access
SSRF1-SSRF3 (Server-Side Request Forgery)	Validate/allowlist external endpoints before requests
TM1-TM4 (Tool Misuse)	Validate tool parameters; never concatenate untrusted input into shell commands

gitleaks

Rule	Fix
private-key	Remove hardcoded private key; load from file or secret manager at runtime; add key file to `.gitignore`
(other rules)	Replace hardcoded credential with environment variable or secret manager reference; see https://gitleaks.io/docs/secrets

Remediation Workflow (audit -> fix -> verify)

After running the audit and getting a FAIL, follow this sequence:

Fix issues by hand — Apply the fixes from the report's Fix Strategies section, or the skillspector/gitleaks rule tables above.
Re-run the full audit to verify PASS.

Markdown style and SKILL.md spec issues are not audited by this skill; use external tools like markdownlint-cli2 --fix only if you need to fix markdown style separately.

CI/CD Integration

# CI 场景下 checkout 的仓库即本 skill 自身, 脚本来源可信, 相对路径无 RCE 风险
# (与 Core Commands 安全要求不冲突: 那里禁止的是在"被审计技能目录"内跑相对路径)
jobs:
  skill-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run audit
        run: python3 scripts/skill_audit.py --target . --output-dir .
      - name: Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: skill-gate-report
          path: skill-gate-report-*.txt

Configuration Files

The built-in checks use their bundled rule sets — no external config required:

scripts/checks/skillspector_rules.json — skillspector rules (52 rules / 609 patterns)
scripts/checks/gitleaks_rules.json — gitleaks rules (43 rules)

.markdownlint.json and skillcheck.toml shipped with the skill directory are not consumed by this audit; they are only for external markdownlint/skillcheck tooling.

Security Scanning

Why skillspector static-only mode has limitations

skillspector runs with --no-llm mode (static analysis only). Gaps:

Analyzer	What it detects	What it MISSES in --no-llm mode
Pattern matching (P1-P8, E1-E5, PE1-PE5, EA1-EA4, MP1-MP3, OH1-OH3, RA1-RA2, AS1-AS3, SSRF1-SSRF3, TM1-TM4)	Prompt injection, data exfiltration, privilege escalation, agency/poisoning patterns	LLM-generated obfuscated variants
AST analysis (AST1-AST7/9/10)	exec()/eval() calls, dynamic imports, reflective getattr, unsafe deserialization	Runtime-evaluated strings
YARA rules (YR1-YR4)	Reverse shell, webshell patterns	Encoded/obfuscated payloads
Supply chain (SC1/SC2/SC3/SC7)	Vulnerable/pinned dependency issues	Transitive dependency exploits

Complementary tools

Tool	Detects	Install
skillspector (built-in, --no-llm)	Prompt injection, reverse shell, command injection, data exfiltration, privilege escalation, supply chain	Auto-installed
gitleaks (built-in)	43 rules: API keys, passwords, private keys, tokens	Auto-installed
gitcode-security-scanner	Generic keyword credentials, Chinese keywords, SQL injection, debug leakage	From DTSE-SKILL repo

Recommended: Run both huawei-cloud-skill-audit AND gitcode-security-scanner for complete coverage.

Output Format

Report is a plain text file with four sections (Scanned Skills, Issue Summary, Issue Details, Fix Strategies) followed by a Gate Verdict (PASS/FAIL).

Verification Method

Run audit

# AUDIT_DIR 见 Core Commands 安全要求(本 skill 安装目录绝对路径)
skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .
# 等效直接执行（⚠️ 仅调试/离线场景, 正式使用请经 skill-quality-cli run 包裹以保证质量上报）
python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .

Verify fix

# Fix issues from the report's Fix Strategies section, then re-run audit
skill-quality-cli run --skill-name huawei-cloud-skill-audit -- python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .
# 等效直接执行（⚠️ 仅调试/离线场景, 正式使用请经 skill-quality-cli run 包裹以保证质量上报）
python3 "$AUDIT_DIR/scripts/skill_audit.py" --target .

Check gate verdict

# Gate Verdict: PASS = 无 CRITICAL/ERROR 发现(WARNING 带记录理由后可接受)
# Gate Verdict: FAIL = 存在 CRITICAL 或 ERROR 发现(与 references/verification-method.md、security-audit-guide.md 一致)

Reference Documents

references/iam-policies.md — IAM permissions required for skill audit
references/verification-method.md — Detailed verification procedures
references/acceptance-criteria.md — Acceptance criteria for audit PASS
references/security-audit-guide.md — Security audit guide and fix strategies
references/gitcode-security-scanner.md — Complementary scanner usage guide
scripts/ensure_cli.sh — Idempotent skill-quality-cli installer (auto-installs if absent)

Best Practices

Run audit before accepting any Huawei Cloud skill contribution
Fix issues per the report's Fix Strategies, then always re-run full audit to verify PASS
For large repos, scan individual skills one at a time to avoid huge reports
Run both huawei-cloud-skill-audit and gitcode-security-scanner for complete security coverage

Notes

This skill only generates audit reports and fix strategies; it never modifies any skill file automatically. Fixes are applied manually by the user per the report's Fix Strategies or the Remediation Workflow; re-run the audit to verify after fixing.
Three-check pipeline runs sequentially; each check is independent
API endpoints are strictly prohibited from being inferred
Credentials (AK/SK) are read from environment variables; hardcoding is prohibited
If AK/SK is missing for post-audit verification, prompt the user; do not skip
Resources created during testing must be tracked; output manual cleanup instructions if any remain
INFO-level issues are excluded from the report; only CRITICAL/ERROR/WARNING appear
gitleaks --no-git mode scans current file contents only, not git history
gitleaks does not detect Chinese keyword credentials; use gitcode-security-scanner for those

Edge Cases

Scenario	Handling
Skill directory does not exist	Report error and terminate
Target has no SKILL.md and no subdirs with SKILL.md	Report error: no skills found
Built-in rules file missing	Check skipped with warning (built-in rules JSON is the only default path; external auto-download is not performed — fail-closed)
Python version < 3.12	Built-in pure Python checks still work (Python 3.10+); external binaries not auto-detected (fail-closed), so no version-specific external fallback
Large repo produces huge report	Scan individual skills; use head/tail to read summary
gitleaks false positive	Add to .gitleaksignore file
skillspector exit code 1	Findings reported per rule severity; risk score is display-only, not a gate condition

Design Principles

Three-Check Pipeline — Each check is independent and contributes to the overall gate verdict
Auto-Install — Missing tools are installed automatically on first run
Chain Verification — All enabled checks must pass for gate verdict PASS
Agent-proof — Write operations require user confirmation; automatic gate bypassing is not allowed
Data-Driven — Report is structured text with clear severity levels and fix strategies
Batch Repeatable — Same skill can be audited repeatedly; each run writes a fresh timestamped report
Credential Security — No hardcoded AK/SK; read from environment variables
Least Privilege — IAM policies follow minimum required permissions