This skill strictly forbids the following delete operations, regardless of user requests:

DeleteBucket

obsutil rm -bucket

DeleteObject

obsutil rm

DeleteObjects

obsutil rm -r

obsutil rm -bucket -r

If a user requests a delete operation, you must refuse and inform: "Per security constraints, this skill does not allow delete operations (delete bucket/object/batch delete/empty bucket). Please use the Huawei Cloud OBS console or obsutil manually."

Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required Run

hcloud version

to verify version >= 3.2.0. If not installed or version is too low, see references/cli-installation-guide.md for installation guide.

hcloud version

Prerequisite check: obsutil >= 5.5.0 required (for upload features) File/directory upload requires the Huawei Cloud obsutil CLI tool. Run

obsutil version

to verify version >= 5.5.0. If not installed, see references/cli-installation-guide.md for installation guide.

obsutil version

Prerequisite check: obsutil credential configuration required

The hcloud OBS module uses obsutil under the hood, which requires separate AK/SK and Endpoint configuration. Before performing OBS operations, you must check whether obsutil credentials are configured:

bash

hcloud obs ls -limit=1

If the response is

Please set ak, sk and endpoint in the configuration file!

or

InvalidAccessKeyId

, obsutil credentials are not configured.

Resolution: Provide the following example command and have the user configure it in their terminal (do not ask the user to provide AK/SK directly in the conversation):

obsutil credentials are not configured. Please run the following command in your terminal to configure (AK/SK can be obtained from the Huawei Cloud console "My Credentials" page):

  hcloud obs config -i=<YourAK> -k=<YourSK> -e=obs.<Region>.myhuaweicloud.com

Example (Guangzhou region):
  hcloud obs config -i=<YourAK> -k=<YourSK> -e=obs.cn-south-1.myhuaweicloud.com

Common Endpoints:
  cn-north-4  → obs.cn-north-4.myhuaweicloud.com
  cn-east-3   → obs.cn-east-3.myhuaweicloud.com
  cn-south-1  → obs.cn-south-1.myhuaweicloud.com
  cn-southwest-2 → obs.cn-southwest-2.myhuaweicloud.com

Retry after configuration is complete.

Prohibited actions:

• ❌ Do not ask the user to provide AK/SK directly in the conversation
• ❌ Do not extract AK/SK from hcloud config files (credentials are encrypted and cannot be used directly)
• ❌ Do not skip the credential check before performing OBS operations

⚠️ hcloud parameter format requirements

hcloud (KooCLI) all parameters must use the

--param=value

format (connected with equals sign); space-separated format is not supported.

✅ Correct:

hcloud OBS ListBuckets --region=cn-south-1

❌ Incorrect:

hcloud OBS ListBuckets --region cn-south-1

Prerequisite check: Huawei Cloud credentials required

Security rules (must be followed):

• Prohibited from reading, echoing, or printing AK/SK values
• Prohibited from asking the user to input AK/SK directly in the conversation
• Prohibited from using

  hcloud configure set

  to pass plaintext credential values
• Prohibited from accepting AK/SK directly provided by the user in the conversation
• Only allowed to read credentials from environment variables or configured CLI config files

⚠️ Important: Handling user-provided credentials

If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):

1. Stop immediately - Do not execute any commands
2. Politely refuse and return the following message:

   For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.
   
   Please use one of the following secure methods to configure credentials:
   
   Method 1: Interactive configuration (recommended)
       hcloud configure
       # Enter AK/SK as prompted; credentials will be securely stored in a local config file
   
   Method 2: Environment variable configuration
       export HUAWEICLOUD_SDK_AK=<your-access-key-id>
       export HUAWEICLOUD_SDK_SK=<your-access-key-secret>
   
   After configuration is complete, please retry your request.

3. Do not continue executing any Huawei Cloud operations until credentials are configured

Check CLI configuration:

bash

   hcloud configure list

Check whether the output contains valid configuration (AK/SK, IAM, etc.).

If no valid credentials exist, stop here.

• obs:bucket:list

  — List buckets

• obs:bucket:get

  — Get bucket attributes (capacity, object count)

• obs:object:get

  — Read object information

• obs:object:put

  — Upload objects