huawei-cloud-skill-audit

Huawei Cloud Skill Audit

Two-check security pipeline for auditing Huawei Cloud skills — security gate.

---

Overview

Scan a single Huawei Cloud skill directory or a folder of skills, run two security gates, and generate a structured report with issue details and fix strategies.

Two checks:

---

Prerequisites

1. Python 3.10+ — for the built-in skillspector and gitleaks checks
2. Node.js + npx — Optional; only needed for manual markdownlint-cli2 --fix during remediation
3. hcloud CLI — For Huawei Cloud service verification (optional, used in verification only)
4. Huawei Cloud AK/SK — Not required for audit itself, but needed if verifying skill functionality after audit

skillspector and gitleaks are built-in (pure Python) — no external binary or pip install needed. External binaries are used as fallback if available on PATH.

To skip fallback auto-install of external binaries, use --no-install flag.

---

Workflow

Input (skill path or folder)
    │
    ├── Discover Skills ──── Find SKILL.md in target or subdirectories
    │
    ├── Run Two Checks ────
    │   1. skillspector → AI security scan (47 rules, 439 patterns)
    │   2. gitleaks → Credential leak detection
    │
    ├── Build Report ────
    │   Section 1: Scanned Skills
    │   Section 2: Issue Summary (by severity)
    │   Section 3: Issue Details (per-issue)
    │   Section 4: Fix Strategies (per rule/category)
    │
    └── Gate Verdict ──── PASS or FAIL

---

Scan Levels

Severity filtering applies only to SkillSpector. gitleaks always reports all findings regardless of scan level.

---

KooCLI Command Format Standard

This skill does not directly invoke hcloud CLI commands. It audits skill directories locally. However, when verifying a skill's functionality after audit, the standard KooCLI format applies:

hcloud   --cli-region= [--key=value ...]

---

Core Commands

Scan a single skill

python3 scripts/skill_audit.py --target /path/to/my-skill

Scan a folder of skills

python3 scripts/skill_audit.py --target /path/to/skills-folder

Scan with specific level

python3 scripts/skill_audit.py --target /path/to/skills --scan-level quick

Selective check execution

python3 scripts/skill_audit.py --target /path/to/skills --checks skillspector
python3 scripts/skill_audit.py --target /path/to/skills --skip-checks gitleaks

Run with custom tool paths

python3 scripts/skill_audit.py \
  --target /path/to/skill-or-folder \
  --scan-level standard \
  --skillspector /path/to/skillspector \
  --gitleaks /path/to/gitleaks \
  --node-bin /opt/nvm/versions/node/v18.20.8/bin

Available --scan-level values: critical (default), high, quick, standard, deep. Available --checks: skillspector, gitleaks. Use --skip-checks to exclude specific checks.

---

Parameter Confirmation

---

Report Structure

Report is saved as skill-gate-report-.txt in the parent directory of the scanned path.

Four sections:

1. Scanned Skills — list of all skills found
2. Issue Summary — count by severity (CRITICAL/ERROR/WARNING) with rule breakdown (INFO excluded)
3. Issue Details — per-issue: skill name, rule, line number, snippet, message
4. Fix Strategies — actionable remediation for each unique rule/category

---

Fix Strategies Reference

skillspector

gitleaks

---

Remediation Workflow (audit -> fix -> verify)

After running the audit and getting a FAIL, follow this sequence:

1. Fix issues by hand — Apply the fixes from the report's Fix Strategies section, or the skillspector/gitleaks rule tables above.
2. Re-run the full audit to verify PASS.

Markdown style and SKILL.md spec issues are not audited by this skill; use external tools like markdownlint-cli2 --fix only if you need to fix markdown style separately.

---

CI/CD Integration

jobs:
  skill-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run audit
        run: python3 scripts/skill_audit.py --target . --output-dir .
      - name: Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: skill-gate-report
          path: skill-gate-report-*.txt

---

Configuration Files

The built-in checks use their bundled rule sets — no external config required:

• scripts/checks/skillspector_rules.json — skillspector rules (47 rules / 439 patterns)
• scripts/checks/gitleaks_rules.json — gitleaks rules (222 rules)

.markdownlint.json and skillcheck.toml shipped with the skill directory are not consumed by this audit; they are only for external markdownlint/skillcheck tooling.

---

Security Scanning

Why skillspector static-only mode has limitations

skillspector runs with --no-llm mode (static analysis only). Gaps:

Complementary tools

Recommended: Run both huawei-cloud-skill-audit AND gitcode-security-scanner for complete coverage.

---

Output Format

Report is a plain text file with four sections (Scanned Skills, Issue Summary, Issue Details, Fix Strategies) followed by a Gate Verdict (PASS/FAIL).

---

Verification Method

Run audit

python3 scripts/skill_audit.py --target /path/to/skill

Verify fix

# Fix issues from the report's Fix Strategies section, then re-run audit
python3 scripts/skill_audit.py --target /path/to/skill

Check gate verdict

# Gate Verdict: PASS = all checks passed
# Gate Verdict: FAIL = one or more checks have issues

---

Reference Documents

• references/iam-policies.md — IAM permissions required for skill audit
• references/verification-method.md — Detailed verification procedures
• references/acceptance-criteria.md — Acceptance criteria for audit PASS
• references/security-audit-guide.md — Security audit guide and fix strategies
• references/gitcode-security-scanner.md — Complementary scanner usage guide

---

Best Practices

• Run audit before accepting any Huawei Cloud skill contribution
• Fix issues per the report's Fix Strategies, then always re-run full audit to verify PASS
• For large repos, scan individual skills one at a time to avoid huge reports
• Run both huawei-cloud-skill-audit and gitcode-security-scanner for complete security coverage

---

Notes

• 本 skill 仅生成审计报告和修复策略，不自动修改任何技能文件；修复由用户按报告 Fix Strategies 或 Remediation Workflow 手动执行，修复后需重新运行审计验证
• Two-check pipeline runs sequentially; each check is independent
• API endpoints are strictly prohibited from being inferred
• Credentials (AK/SK) are read from environment variables; hardcoding is prohibited
• If AK/SK is missing for post-audit verification, prompt the user; do not skip
• Resources created during testing must be tracked; output manual cleanup instructions if any remain
• INFO-level issues are excluded from the report; only CRITICAL/ERROR/WARNING appear
• gitleaks --no-git mode scans current file contents only, not git history
• gitleaks does not detect Chinese keyword credentials; use gitcode-security-scanner for those

---

Edge Cases

---

Design Principles

• Two-Check Pipeline — Each check is independent and contributes to the overall gate verdict
• Auto-Install — Missing tools are installed automatically on first run
• Chain Verification — All enabled checks must pass for gate verdict PASS
• Agent-proof — Write operations require user confirmation; automatic gate bypassing is not allowed
• Data-Driven — Report is structured text with clear severity levels and fix strategies
• Batch Repeatable — Same skill can be audited repeatedly; --fresh resets
• Credential Security — No hardcoded AK/SK; read from environment variables
• Least Privilege — IAM policies follow minimum required permissions