Back to Details

huawei-cloud-skill-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Huawei Cloud Skill Audit

华为云技能审计

Two-check security pipeline for auditing Huawei Cloud skills — security gate.
用于审计华为云技能的双检查安全管道——安全门禁。

Overview

概述

Scan a single Huawei Cloud skill directory or a folder of skills, run two security gates, and generate a structured report with issue details and fix strategies.
Two checks:
#ToolCheck ContentImplementation
1skillspectorAI skill security scanner: 47 rules / 439 patterns across 17 categories (prompt injection, data exfiltration, privilege escalation, supply chain, behavioral AST, taint tracking, MCP analysis, YARA)Built-in (pure Python, 47 rules + AST analysis)
2gitleaksCredential leak scan: 222 rules detecting hardcoded API keys, passwords, private keys, tokens, and 800+ credential formatsBuilt-in (pure Python, 222 rules + Shannon entropy)
扫描单个华为云技能目录或技能文件夹，运行两道安全门禁，并生成包含问题详情与修复策略的结构化报告。
两项检查：
#工具检查内容实现方式
1skillspectorAI技能安全扫描器：覆盖17个类别的47条规则/439种模式（提示注入、数据泄露、权限提升、供应链、行为AST、污点追踪、MCP分析、YARA）内置（纯Python，47条规则+AST分析）
2gitleaks凭证泄露扫描：222条规则，检测硬编码API密钥、密码、私钥、令牌及800+种凭证格式内置（纯Python，222条规则+香农熵）

Prerequisites

前置条件

  1. Python 3.10+ — for the built-in skillspector and gitleaks checks
  2. Node.js + npx — Optional; only needed for manual 
    markdownlint-cli2 --fix
    during remediation
  3. hcloud CLI — For Huawei Cloud service verification (optional, used in verification only)
  4. Huawei Cloud AK/SK — Not required for audit itself, but needed if verifying skill functionality after audit
skillspector and gitleaks are built-in (pure Python) — no external binary or pip install needed. External binaries are used as fallback if available on PATH.
To skip fallback auto-install of external binaries, use 
--no-install
flag.
  1. Python 3.10+ — 用于内置的skillspector和gitleaks检查
  2. Node.js + npx — 可选；仅在修复期间手动执行
    markdownlint-cli2 --fix
    时需要
  3. hcloud CLI — 用于华为云服务验证（可选，仅在验证阶段使用）
  4. 华为云AK/SK — 审计本身不需要，但如果在审计后验证技能功能则需要
skillspector和gitleaks为内置（纯Python）——无需外部二进制文件或pip安装。如果PATH中存在外部二进制文件，会将其作为回退选项使用。
要跳过外部二进制文件的自动回退安装，使用
--no-install
参数。

Workflow

工作流程

Input (skill path or folder)
    │
    ├── Discover Skills ──── Find SKILL.md in target or subdirectories
    │
    ├── Run Two Checks ────
    │   1. skillspector → AI security scan (47 rules, 439 patterns)
    │   2. gitleaks → Credential leak detection
    │
    ├── Build Report ────
    │   Section 1: Scanned Skills
    │   Section 2: Issue Summary (by severity)
    │   Section 3: Issue Details (per-issue)
    │   Section 4: Fix Strategies (per rule/category)
    │
    └── Gate Verdict ──── PASS or FAIL
Input (skill path or folder)
    │
    ├── Discover Skills ──── Find SKILL.md in target or subdirectories
    │
    ├── Run Two Checks ────
    │   1. skillspector → AI security scan (47 rules, 439 patterns)
    │   2. gitleaks → Credential leak detection
    │
    ├── Build Report ────
    │   Section 1: Scanned Skills
    │   Section 2: Issue Summary (by severity)
    │   Section 3: Issue Details (per-issue)
    │   Section 4: Fix Strategies (per rule/category)
    │
    └── Gate Verdict ──── PASS or FAIL

Scan Levels

扫描级别

LevelAnalyzersSpeedUse Case
critical
CRITICAL severity rules only (P5 harmful content)FastStrictest gate, default
high
CRITICAL + ERROR severity rulesFastBlock high-risk issues
quick
Pattern matching only (all static regex rules)FastQuick pre-commit check
standard
All static analyzers (quick + AST + taint tracking)MediumCI/CD gate
deep
Standard + MCP analysis (least privilege, tool poisoning, rug pull)SlowerPre-release full audit
Severity filtering applies only to SkillSpector. gitleaks always reports all findings regardless of scan level.
级别分析器速度使用场景
critical
仅CRITICAL severity规则（P5有害内容）快最严格的门禁，默认选项
high
CRITICAL + ERROR severity规则快拦截高风险问题
quick
仅模式匹配（所有静态正则规则）快快速预提交检查
standard
所有静态分析器（quick + AST + 污点追踪）中等CI/CD门禁
deep
Standard + MCP分析（最小权限、工具投毒、rug pull）较慢发布前全面审计
Severity过滤仅适用于SkillSpector。无论扫描级别如何，gitleaks都会报告所有检测结果。

KooCLI Command Format Standard

KooCLI命令格式标准

This skill does not directly invoke 
hcloud
CLI commands. It audits skill directories locally. However, when verifying a skill's functionality after audit, the standard KooCLI format applies:
bash
hcloud <Service> <Operation> --cli-region=<region> [--key=value ...]
本技能不直接调用
hcloud
CLI命令。它在本地审计技能目录。不过，在审计后验证技能功能时，需遵循标准KooCLI格式：
bash
hcloud <Service> <Operation> --cli-region=<region> [--key=value ...]

Core Commands

核心命令

Scan a single skill

扫描单个技能

bash
python3 scripts/skill_audit.py --target /path/to/my-skill
bash
python3 scripts/skill_audit.py --target /path/to/my-skill

Scan a folder of skills

扫描技能文件夹

bash
python3 scripts/skill_audit.py --target /path/to/skills-folder
bash
python3 scripts/skill_audit.py --target /path/to/skills-folder

Scan with specific level

指定扫描级别进行扫描

bash
python3 scripts/skill_audit.py --target /path/to/skills --scan-level quick
bash
python3 scripts/skill_audit.py --target /path/to/skills --scan-level quick

Selective check execution

选择性执行检查

bash
python3 scripts/skill_audit.py --target /path/to/skills --checks skillspector
python3 scripts/skill_audit.py --target /path/to/skills --skip-checks gitleaks
bash
python3 scripts/skill_audit.py --target /path/to/skills --checks skillspector
python3 scripts/skill_audit.py --target /path/to/skills --skip-checks gitleaks

Run with custom tool paths

使用自定义工具路径运行

bash
python3 scripts/skill_audit.py \
  --target /path/to/skill-or-folder \
  --scan-level standard \
  --skillspector /path/to/skillspector \
  --gitleaks /path/to/gitleaks \
  --node-bin /opt/nvm/versions/node/v18.20.8/bin
Available 
--scan-level
values: 
critical
(default), 
high
, 
quick
, 
standard
, 
deep
. Available 
--checks
: 
skillspector
, 
gitleaks
. Use 
--skip-checks
to exclude specific checks.
bash
python3 scripts/skill_audit.py \
  --target /path/to/skill-or-folder \
  --scan-level standard \
  --skillspector /path/to/skillspector \
  --gitleaks /path/to/gitleaks \
  --node-bin /opt/nvm/versions/node/v18.20.8/bin
可用的
--scan-level
值：
critical
（默认）、
high
、
quick
、
standard
、
deep
。 可用的
--checks
：
skillspector
、
gitleaks
。 使用
--skip-checks
排除特定检查。

Parameter Confirmation

参数确认

ParameterRequiredDescriptionExample
--target
YesSingle skill dir or parent folder of skills
/home/user/.hermes/skills/huawei-cloud-ecs-manage
--output-dir
NoReport output directory (default: parent of target)
--output-dir ./reports
--scan-level
NoScan depth: critical/high/quick/standard/deep (default: critical)
--scan-level deep
--checks
NoComma-separated checks to run (default: all)；可用值仅 
skillspector
,
gitleaks
。与 
--skip-checks
互斥，不可同时使用
--checks skillspector
--skillspector
NoSkillSpector binary path override
--skillspector /usr/local/bin/skillspector
--gitleaks
Nogitleaks binary path override
--gitleaks /usr/local/bin/gitleaks
--skip-checks
NoComma-separated checks to skip；与 
--checks
互斥，不可同时使用
--skip-checks gitleaks
--no-install
NoSkip auto-install of tools
--no-install
参数是否必填描述示例
--target
是单个技能目录或技能父文件夹
/home/user/.hermes/skills/huawei-cloud-ecs-manage
--output-dir
否报告输出目录（默认：目标路径的父目录）
--output-dir ./reports
--scan-level
否扫描深度：critical/high/quick/standard/deep（默认：critical）
--scan-level deep
--checks
否要运行的检查（逗号分隔，默认：全部）；可用值仅为
skillspector
、
gitleaks
。与
--skip-checks
互斥，不可同时使用
--checks skillspector
--skillspector
否覆盖SkillSpector二进制文件路径
--skillspector /usr/local/bin/skillspector
--gitleaks
否覆盖gitleaks二进制文件路径
--gitleaks /usr/local/bin/gitleaks
--skip-checks
否要跳过的检查（逗号分隔）；与
--checks
互斥，不可同时使用
--skip-checks gitleaks
--no-install
否跳过工具自动安装
--no-install

Report Structure

报告结构

Report is saved as 
skill-gate-report-<timestamp>.txt
in the parent directory of the scanned path.
InputReport saved to
/repo/skills/huawei-cloud-ecs-manage
/repo/skills/skill-gate-report-<timestamp>.txt
/repo/skills
/repo/skill-gate-report-<timestamp>.txt
Four sections:
  1. Scanned Skills — list of all skills found
  2. Issue Summary — count by severity (CRITICAL/ERROR/WARNING) with rule breakdown (INFO excluded)
  3. Issue Details — per-issue: skill name, rule, line number, snippet, message
  4. Fix Strategies — actionable remediation for each unique rule/category
报告保存为
skill-gate-report-<timestamp>.txt
，位于扫描路径的父目录中。
输入路径报告保存路径
/repo/skills/huawei-cloud-ecs-manage
/repo/skills/skill-gate-report-<timestamp>.txt
/repo/skills
/repo/skill-gate-report-<timestamp>.txt
包含四个部分：
  1. 已扫描技能 — 所有发现的技能列表
  2. 问题摘要 — 按严重程度（CRITICAL/ERROR/WARNING）统计的问题数量，包含规则细分（INFO级别除外）
  3. 问题详情 — 每个问题的技能名称、规则、行号、代码片段、提示信息
  4. 修复策略 — 针对每条独特规则/类别的可操作修复方案

Fix Strategies Reference

修复策略参考

skillspector

skillspector

RuleFix
P1-P5 (Prompt Injection)Do not embed user-controllable input in system prompts; use template variables with explicit escaping
E1-E4 (Data Exfiltration)Remove external URLs; use env vars for API endpoints; restrict network access in tool definitions
PE1-PE3 (Privilege Escalation)Avoid sudo/root commands; use capability-based permissions; do not disable security controls
AST1-AST3 (Behavioral AST)Replace exec()/eval() with safer alternatives; use importlib with allowlists
YR1-YR4 (YARA)Remove reverse shell/webshell patterns; move server functionality to separate controlled service
SC1-SC6 (Supply Chain)Pin dependency versions with hashes; update vulnerable dependencies
LP1-LP4 (MCP Least Privilege)Reduce MCP tool permissions to minimum required
TP1-TP4 (MCP Tool Poisoning)Validate MCP tool metadata against manifest
规则修复方案
P1-P5（提示注入）不要在系统提示中嵌入用户可控输入；使用带显式转义的模板变量
E1-E4（数据泄露）移除外部URL；使用环境变量存储API端点；在工具定义中限制网络访问
PE1-PE3（权限提升）避免使用sudo/root命令；使用基于能力的权限；不要禁用安全控制
AST1-AST3（行为AST）用更安全的替代方案替换exec()/eval()；使用带允许列表的importlib
YR1-YR4（YARA）移除反向shell/webshell模式；将服务器功能移至单独的受控服务
SC1-SC6（供应链）使用哈希固定依赖版本；更新易受攻击的依赖
LP1-LP4（MCP最小权限）将MCP工具权限降至所需最低水平
TP1-TP4（MCP工具投毒）根据清单验证MCP工具元数据

gitleaks

gitleaks

RuleFix
generic-api-keyReplace hardcoded API key/secret with 
os.environ.get("VAR")
or 
${VAR}
; add to 
.gitleaksignore
if false positive
private-keyRemove hardcoded private key; load from file or secret manager at runtime; add key file to 
.gitignore
(other rules)Replace hardcoded credential with environment variable or secret manager reference; see https://gitleaks.io/docs/secrets
规则修复方案
generic-api-key用
os.environ.get("VAR")
或
${VAR}
替换硬编码的API密钥/密钥；如果是误报，添加到
.gitleaksignore
private-key删除硬编码的私钥；在运行时从文件或密钥管理器加载；将密钥文件添加到
.gitignore
(其他规则)用环境变量或密钥管理器引用替换硬编码凭证；详见https://gitleaks.io/docs/secrets

Remediation Workflow (audit -> fix -> verify)

修复工作流程（审计 -> 修复 -> 验证）

After running the audit and getting a FAIL, follow this sequence:
  1. Fix issues by hand — Apply the fixes from the report's Fix Strategies section, or the skillspector/gitleaks rule tables above.
  2. Re-run the full audit to verify PASS.
Markdown style and SKILL.md spec issues are not audited by this skill; use external tools like 
markdownlint-cli2 --fix
only if you need to fix markdown style separately.
运行审计并得到FAIL结果后，请遵循以下步骤：
  1. 手动修复问题 — 应用报告中修复策略部分的方案，或上述skillspector/gitleaks规则表格中的修复方法。
  2. 重新运行完整审计以验证是否通过。
本技能不审计Markdown格式和SKILL.md规范问题；如果需要单独修复Markdown格式，请使用
markdownlint-cli2 --fix
等外部工具。

CI/CD Integration

CI/CD集成

yaml
jobs:
  skill-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run audit
        run: python3 scripts/skill_audit.py --target . --output-dir .
      - name: Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: skill-gate-report
          path: skill-gate-report-*.txt
yaml
jobs:
  skill-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run audit
        run: python3 scripts/skill_audit.py --target . --output-dir .
      - name: Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: skill-gate-report
          path: skill-gate-report-*.txt

Configuration Files

配置文件

The built-in checks use their bundled rule sets — no external config required:
  • scripts/checks/skillspector_rules.json
    — skillspector rules (47 rules / 439 patterns)
  • scripts/checks/gitleaks_rules.json
    — gitleaks rules (222 rules)
.markdownlint.json
and 
skillcheck.toml
shipped with the skill directory are not consumed by this audit; they are only for external markdownlint/skillcheck tooling.
内置检查使用捆绑的规则集——无需外部配置：
  • scripts/checks/skillspector_rules.json
    — skillspector规则（47条规则/439种模式）
  • scripts/checks/gitleaks_rules.json
    — gitleaks规则（222条规则）
技能目录中附带的
.markdownlint.json
和
skillcheck.toml
不会被本审计工具使用；它们仅用于外部markdownlint/skillcheck工具。

Security Scanning

安全扫描

Why skillspector static-only mode has limitations

为什么skillspector静态模式存在局限性

skillspector
runs with 
--no-llm
mode (static analysis only). Gaps:
AnalyzerWhat it detectsWhat it MISSES in --no-llm mode
Pattern matching (P1-P5, E1-E4, PE1-PE3)Prompt injection, data exfiltration, privilege escalation patternsLLM-generated obfuscated variants
AST analysis (AST1-AST3)exec()/eval() calls, dynamic importsRuntime-evaluated strings
YARA rules (YR1-YR4)Reverse shell, webshell patternsEncoded/obfuscated payloads
Supply chain (SC1-SC6)Vulnerable/pinned dependency issuesTransitive dependency exploits
skillspector
以
--no-llm
模式运行（仅静态分析）。存在以下缺口：
分析器检测内容--no-llm模式下遗漏的内容
模式匹配（P1-P5、E1-E4、PE1-PE3）提示注入、数据泄露、权限提升模式LLM生成的混淆变体
AST分析（AST1-AST3）exec()/eval()调用、动态导入运行时评估的字符串
YARA规则（YR1-YR4）反向shell、webshell模式编码/混淆的payload
供应链（SC1-SC6）易受攻击/固定依赖问题传递依赖漏洞

Complementary tools

补充工具

ToolDetectsInstall
skillspector (built-in, --no-llm)Prompt injection, reverse shell, command injection, data exfiltration, privilege escalation, supply chainAuto-installed
gitleaks (built-in)800+ credential types: API keys, passwords, private keys, tokensAuto-installed
gitcode-security-scannerGeneric keyword credentials, Chinese keywords, SQL injection, debug leakageFrom DTSE-SKILL repo
Recommended: Run both 
huawei-cloud-skill-audit
AND 
gitcode-security-scanner
for complete coverage.
工具检测内容安装方式
skillspector（内置，--no-llm）提示注入、反向shell、命令注入、数据泄露、权限提升、供应链自动安装
gitleaks（内置）800+种凭证类型：API密钥、密码、私钥、令牌自动安装
gitcode-security-scanner通用关键字凭证、中文关键字、SQL注入、调试信息泄露来自DTSE-SKILL仓库
推荐：同时运行
huawei-cloud-skill-audit
和
gitcode-security-scanner
以实现全面覆盖。

Output Format

输出格式

Report is a plain text file with four sections (Scanned Skills, Issue Summary, Issue Details, Fix Strategies) followed by a Gate Verdict (PASS/FAIL).
报告为纯文本文件，包含四个部分（已扫描技能、问题摘要、问题详情、修复策略），随后是门禁Verdict（PASS/FAIL）。

Verification Method

验证方法

Run audit

运行审计

bash
python3 scripts/skill_audit.py --target /path/to/skill
bash
python3 scripts/skill_audit.py --target /path/to/skill

Verify fix

验证修复

bash
undefined
bash
undefined

Fix issues from the report's Fix Strategies section, then re-run audit

根据报告的修复策略部分修复问题，然后重新运行审计

python3 scripts/skill_audit.py --target /path/to/skill
undefined
python3 scripts/skill_audit.py --target /path/to/skill
undefined

Check gate verdict

检查门禁Verdict

bash
undefined
bash
undefined

Gate Verdict: PASS = all checks passed

Gate Verdict: PASS = 所有检查通过

Gate Verdict: FAIL = one or more checks have issues

Gate Verdict: FAIL = 一项或多项检查存在问题


---

---

Reference Documents

参考文档

  • references/iam-policies.md
    — IAM permissions required for skill audit
  • references/verification-method.md
    — Detailed verification procedures
  • references/acceptance-criteria.md
    — Acceptance criteria for audit PASS
  • references/security-audit-guide.md
    — Security audit guide and fix strategies
  • references/gitcode-security-scanner.md
    — Complementary scanner usage guide
  • references/iam-policies.md
    — 技能审计所需的IAM权限
  • references/verification-method.md
    — 详细验证流程
  • references/acceptance-criteria.md
    — 审计通过的验收标准
  • references/security-audit-guide.md
    — 安全审计指南及修复策略
  • references/gitcode-security-scanner.md
    — 补充扫描器使用指南

Best Practices

最佳实践

  • Run audit before accepting any Huawei Cloud skill contribution
  • Fix issues per the report's Fix Strategies, then always re-run full audit to verify PASS
  • For large repos, scan individual skills one at a time to avoid huge reports
  • Run both 
    huawei-cloud-skill-audit
    and 
    gitcode-security-scanner
    for complete security coverage
  • 在接受任何华为云技能贡献前运行审计
  • 根据报告的修复策略修复问题，然后始终重新运行完整审计以验证通过
  • 对于大型仓库，逐个扫描单个技能以避免生成过大的报告
  • 同时运行
    huawei-cloud-skill-audit
    和
    gitcode-security-scanner
    以实现全面安全覆盖

Notes

注意事项

  • 本 skill 仅生成审计报告和修复策略，不自动修改任何技能文件；修复由用户按报告 Fix Strategies 或 Remediation Workflow 手动执行，修复后需重新运行审计验证
  • Two-check pipeline runs sequentially; each check is independent
  • API endpoints are strictly prohibited from being inferred
  • Credentials (AK/SK) are read from environment variables; hardcoding is prohibited
  • If AK/SK is missing for post-audit verification, prompt the user; do not skip
  • Resources created during testing must be tracked; output manual cleanup instructions if any remain
  • INFO-level issues are excluded from the report; only CRITICAL/ERROR/WARNING appear
  • gitleaks 
    --no-git
    mode scans current file contents only, not git history
  • gitleaks does not detect Chinese keyword credentials; use gitcode-security-scanner for those
  • 本skill仅生成审计报告和修复策略，不自动修改任何技能文件；用户需根据报告中的Fix Strategies或Remediation Workflow手动执行修复，修复后需重新运行审计验证
  • 双检查管道按顺序运行；每个检查相互独立
  • 严格禁止推断API端点
  • 凭证（AK/SK）从环境变量读取；禁止硬编码
  • 如果审计后验证缺少AK/SK，需提示用户；不得跳过
  • 必须跟踪测试期间创建的资源；如有剩余资源，需输出手动清理说明
  • INFO级别的问题不包含在报告中；仅显示CRITICAL/ERROR/WARNING级别的问题
  • gitleaks的
    --no-git
    模式仅扫描当前文件内容，不扫描git历史
  • gitleaks不检测中文关键字凭证；请使用gitcode-security-scanner进行检测

Edge Cases

边缘场景

ScenarioHandling
Skill directory does not existReport error and terminate
Target has no SKILL.md and no subdirs with SKILL.mdReport error: no skills found
Built-in rules file missingAuto-download fallback binary (skillspector/gitleaks)
Python version < 3.12External skillspector binary not available; builtin still works
Large repo produces huge reportScan individual skills; use head/tail to read summary
gitleaks false positiveAdd to .gitleaksignore file
skillspector exit code 1Risk score > 50; treated as finding source, not hard failure
场景处理方式
技能目录不存在报告错误并终止
目标路径中没有SKILL.md，且子目录中也没有SKILL.md报告错误：未找到技能
内置规则文件缺失自动下载回退二进制文件（skillspector/gitleaks）
Python版本 < 3.12无法使用外部skillspector二进制文件；内置版本仍可正常工作
大型仓库生成过大报告逐个扫描单个技能；使用head/tail读取摘要
gitleaks误报添加到.gitleaksignore文件
skillspector退出码为1风险得分>50；视为检测到问题，而非严重故障

Design Principles

设计原则

  • Two-Check Pipeline — Each check is independent and contributes to the overall gate verdict
  • Auto-Install — Missing tools are installed automatically on first run
  • Chain Verification — All enabled checks must pass for gate verdict PASS
  • Agent-proof — Write operations require user confirmation; automatic gate bypassing is not allowed
  • Data-Driven — Report is structured text with clear severity levels and fix strategies
  • Batch Repeatable — Same skill can be audited repeatedly; --fresh resets
  • Credential Security — No hardcoded AK/SK; read from environment variables
  • Least Privilege — IAM policies follow minimum required permissions
  • 双检查管道 — 每个检查相互独立，共同决定门禁Verdict
  • 自动安装 — 首次运行时自动安装缺失的工具
  • 链式验证 — 所有启用的检查必须通过才能获得PASS的门禁Verdict
  • 防Agent绕过 — 写入操作需用户确认；不允许自动绕过门禁
  • 数据驱动 — 报告为结构化文本，包含明确的严重级别和修复策略
  • 可批量重复 — 同一技能可重复审计；--fresh参数可重置
  • 凭证安全 — 无硬编码AK/SK；从环境变量读取
  • 最小权限 — IAM策略遵循最小必要权限