Analyze CDN domain traffic anomalies using hcloud CLI. Query billing mode and traffic/bandwidth metrics for specified domains, compare against 3-month baseline and absolute thresholds to identify traffic theft or abuse. Use this skill when the user wants to: (1) analyze CDN domain traffic anomalies, (2) check if a domain has traffic theft or abuse, (3) query CDN billing mode and traffic/bandwidth metrics, (4) compare current traffic against historical baseline. Triggers include: CDN流量异常, 流量异常分析, 域名流量分析, 流量盗刷, 带宽异常, 95带宽异常, 流量突增, 流量对比, 基准分析, traffic anomaly, bandwidth anomaly, CDN traffic analysis, traffic theft detection, baseline comparison
This skill analyzes CDN domain traffic anomalies by querying billing mode and corresponding traffic/bandwidth metrics. It automatically determines the appropriate metric based on the account's billing mode (bw_95, flux, combine_flux, bw, bw_peak), queries historical data over a configurable time range, establishes a 3-month baseline for comparison, and identifies potential traffic theft or abuse using both absolute thresholds and relative baseline deviation.
Key Features:
Automatic billing mode detection and metric selection
Support for all billing modes: bw_95, flux, combine_flux, bw, bw_peak
Comprehensive analysis reports with baseline comparison and daily breakdowns
Tool: hcloud CLI (KooCLI) Timestamp Tool: scripts/cdn_timestamp.py (built-in) Analysis Scope: Past 7 days for current window (configurable); past 3 months for baseline Core Principle: Query only the metric corresponding to the billing mode; use API capabilities efficiently to cover both current and baseline windows with minimal API calls
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids the following operations, regardless of user requests:
Prohibited Operation
API/Command
Reason
❌ Modify domain configuration
ModifyDomainConfig / hcloud CDN UpdateDomain
Write operation; may affect production traffic
❌ Delete domain
DeleteDomain / hcloud CDN DeleteDomain
Irreversible; removes domain from CDN
❌ Disable domain acceleration
DisableDomain / hcloud CDN DisableDomain
Affects production traffic
❌ Modify billing mode
UpdateBillingMode
Financial impact; requires explicit authorization
If a user requests a prohibited operation, you must refuse and inform:
"Per security constraints, this skill does not allow write/delete operations. This skill is read-only for traffic analysis. Please use the Huawei Cloud CDN console or hcloud CLI manually for configuration changes."
Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required
Run hcloud version to verify version >= 3.2.0. If not installed or version is too low,
see references/cli-installation-guide.md for installation guide.
bash
hcloud version
Prerequisite check: Python >= 3.8 required (for timestamp calculation)
Run python --version to verify version >= 3.8.
bash
python --version
Prerequisite check: hcloud credentials configured
Before performing CDN operations, you must verify hcloud credentials are configured:
bash
hcloud configure list
If no valid credentials exist, stop and guide the user to configure credentials.
⚠️ hcloud parameter format requirements
hcloud (KooCLI) all parameters must use the --param=value format (connected with equals sign); space-separated format is not supported.
CDN APIs support multiple regions. It is recommended to use cn-north-4, but the APIs are not limited to this region only.
Query results are region-independent (CDN is a global service).
Recommended: Always use cn-north-4.
Prohibited from reading, echoing, or printing AK/SK values
Prohibited from asking the user to input AK/SK directly in the conversation
Prohibited from using hcloud configure set to pass plaintext credential values
Prohibited from accepting AK/SK directly provided by the user in the conversation
Only allowed to read credentials from environment variables or configured CLI config files
⚠️ Important: Handling user-provided credentials
If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
Stop immediately - Do not execute any commands
Politely refuse and return the following message:
text
For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.
Please use one of the following secure methods to configure credentials:
Method 1: Interactive configuration (recommended)
hcloud configure
# Enter AK/SK as prompted; credentials will be securely stored in a local config file
Method 2: Environment variable configuration
export HUAWEICLOUD_SDK_AK=<your-access-key-id>
export HUAWEICLOUD_SDK_SK=<your-secret-key>
After configuration is complete, please retry your request.
Do not continue executing any Huawei Cloud operations until credentials are configured
Check CLI configuration:
bash
hcloud configure list
Check whether the output contains valid configuration (AK/SK, IAM, etc.).
Query the corresponding metric for the baseline window (past 3 months) based on billing mode.
bw_95: 3 separate calls to ShowBandwidthCalc, each covering one non-overlapping 30-day window (API max range is 31 days). Sleep 0.6s between calls to respect the 2 calls/s rate limit.
flux / bw: The same ShowDomainStats/v2 call from Step 5 covers both current and baseline windows (97 days total). Split the first 90 daily values as baseline, last 7 as current window.
