Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real Huawei Cloud CCE management skill, but it needs review because it can make high-impact cloud changes and its credential-handling guarantees do not fully match the implementation.
Install only if you are comfortable giving the skill authority over real Huawei Cloud CCE infrastructure. Use least-privilege or temporary credentials, avoid broad CCE Administrator credentials when possible, verify remote installers before running them, treat returned kubeconfig as a secret, and manually review any operation that creates public EIPs, changes node scheduling, deletes resources, or changes production capacity.
See [verification-method.md](references/verification-method.md) for detailed verification steps. Quick checklist:
See [verification-method.md](references/verification-method.md) for detailed verification steps. Quick checklist:
> **⚠️ Cost Warning:** > - **Bind EIP** (5.1, 5.2): EIP incurs bandwidth charges. If auto-creating (5.2), inform the user that a new EIP with traffic billing (5 Mbps) will be created. ## 6. Kubeconfig Retrieval | # | Acceptance Item | Verification Method | Expected Result | |---|-----------------|---------------------|-----------------|
> **⚠️ Cost Warning:** > - **Bind EIP** (5.1, 5.2): EIP incurs bandwidth charges. If auto-creating (5.2), inform the user that a new EIP with traffic billing (5 Mbps) will be created. ## 6. Kubeconfig Retrieval | # | Acceptance Item | Verification Method | Expected Result | |---|-----------------|---------------------|-----------------|
```bash # hcloud (KooCLI 7.2+) — Huawei Cloud API calls curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh # kubectl cce — Kubernetes node operations (cordon/uncordon/drain/status) # install per https://kubernetes.io/docs/tasks/tools/
```bash # hcloud (KooCLI 7.2+) — Huawei Cloud API calls curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh # kubectl cce — Kubernetes node operations (cordon/uncordon/drain/status) # install per https://kubernetes.io/docs/tasks/tools/
```bash # hcloud (KooCLI 7.2+) — Huawei Cloud API calls curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh # kubectl cce — Kubernetes node operations (cordon/uncordon/drain/status) # install per https://kubernetes.io/docs/tasks/tools/
# Pass credentials via environment — only set if not already present
# (if HW_ACCESS_KEY is already in os.environ, subprocess inherits it naturally)
env = dict(os.environ)
if not env.get("HW_ACCESS_KEY"):
env["HW_ACCESS_KEY"] = ctx.ak
if not env.get("HW_SECRET_KEY"):return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.return result
def get_cce_kubeconfig(params: Dict[str, str]) -> Dict[str, Any]:
"""Get cluster kubeconfig via CreateKubernetesClusterCert.
The API requires duration (integer days, 1-1827) or expire_at.VirusTotal findings are pending for this skill version.
No suspicious patterns detected.