Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-devkit --skill huawei-iacgit clone --depth 1 https://github.com/huaweicloud/huaweicloud-devkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-iac)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-iac"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-devkit/huawei-iac/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-iac"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-devkit/huawei-iac.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00234 | $0.03837 |
| Opus 5 | $0.00117 | $0.01919 |
| Sonnet 5 | $0.00047 | $0.00767 |
| Haiku 4.5 | $0.00023 | $0.00384 |
Grade A, and why
huawei-iac scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 7. Verify | `curl -I` the site / API; expect 200 | DNS CNAME may take minutes to propagate - not an error | How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huawei Cloud IaC Orchestration
STOP - Do not answer from general knowledge. Follow the 8-stage workflow below in strict order.
Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.
Scope and Routing Guard
- This skill orchestrates the purchase lifecycle of ALL supported resources: proposal → pricing → provisioning → destroy, across every service in the plugin catalog.
- Web app deployment keeps sandbox as the first choice (see
huaweicloud-coreDeployment Target Options). Route here only when the user wants billed, long-term, or multi-resource cloud infrastructure, or explicitly asks for an architecture + cost proposal. - Single-resource tasks go directly to the service skill. This skill adds value for multi-resource orchestration, mandatory cost gating, and ordered destroy.
- A user-specified hosting target (e.g. "部署到 ECS") does NOT exempt the flow: stages 1-5 (code inspection, cost estimate, balance check, risk warnings) still run in full - the user's target choice only narrows stage 2/3 options, it never skips the gates.
Workflow (strict order)
Proactive by design: any deployment intent ("部署一个博客", "搭一套环境", "买个服务器") automatically triggers stages 1-5 BEFORE anything is created. The user NEVER needs to ask for an architecture proposal, cost estimate, or risk warnings - they are built into the flow. Only stages 6-8 (create / verify / manage) wait for explicit user confirmation at the approval gates.
| Stage | What happens | Hard rule |
|---|---|---|
| 1. Scale assessment | FIRST inspect the project code (clone remote repos to a temp dir, or read the local path): tech stack, data services (Redis/MySQL/SQLite...), build artifacts, existing Dockerfile/k8s manifests → then classify or ask scale | NEVER present deployment options (sandbox/ECS/OBS...) before the codebase has been inspected - options without code analysis are guesses. If scale is not stated or clearly inferable, ASK - present the 3 tiers as options with what each includes and its monthly cost band (see references/architectures.md), and let the user choose. Never assume a tier. The scale question and the hosting-target question are SEPARATE questions on separate axes. FunctionGraph filesystem is ephemeral - never recommend SQLite/local files for persistent data |
| 2. Frontend hosting choice | Present BOTH options: (a) OBS+CDN+DNS custom domain, (b) ECS+EIP | For SPA/static frontends (Vue/React dist), OBS hosting must always appear as an option with cost comparison against same-host Nginx - do not silently merge the frontend into a compute node. For option (a) three prerequisites: domain ownership verification (CDN requires a DNS record or file upload first - CDN.00010185 otherwise), ICP filing check, DNS hosting check; domain registration link: https://www.huaweicloud.com/product/domain.html |
| 3. Architecture proposal | ASCII topology tree with dependencies | User confirms before continuing. Architecture decision points must be surfaced as explicit choices, never silently made: (a) app depends on Redis/MySQL/Kafka etc. → managed service (DCS/RDS/DMS, billed) vs same-host install (cheap, ops burden) - state the trade-off and ask; (b) repo ships a Dockerfile / SWR image / k8s manifests → offer container path (Docker on ECS or CCE) alongside source-build path; (c) frontend hosting layer (Nginx same-host vs OBS+CDN). Silent defaults here are a correctness failure |
| 4. Parameter discovery | ListFlavors / ListImages / huaweicloud_list_regions |
Never hardcode flavor/image names |
| 5. Cost + balance gate | Price every resource via BSS ListOnDemandResourceRatings, then query balance |
Balance = 0 → the FIRST message must state: "您的余额为 0，按时长计费的资源（ECS/EIP/RDS 等）下单将失败（Ecs.7000），请先充值或使用免费额度"。充值入口：https://account.huaweicloud.com/usercenter/?region=cn-north-4#/userindex/balanceRecharge 。Remedy priority: (1) FIRST claim the one-time incentive voucher (huaweicloud_voucher_status → huaweicloud_voucher_claim) to offset usage fees; (2) then instruct the user to top up balance (via the link above) if pay-per-use orders are needed, otherwise orders fail with Ecs.7000; (3) free-tier resources (FunctionGraph, small OBS) proceed without any balance. Balance > 0 → report how long it can sustain (balance ÷ monthly estimate). 权限降级（实测）：IAM 用户无 billing:balance:view 时余额查询报 CBC.0151 → 不阻塞流程，明确告知"余额无法程序化查询，请自行核对；若下单报 Ecs.7000 即余额不足"，领券后继续。定价编码逐服务查证，见 references/resource-catalog.md § Pricing |
| 6. Provision | deployment_id, session state, batch approval, ordered creation | See "Provisioning Rules" below |
| 7. Verify | curl -I the site / API; expect 200 |
DNS CNAME may take minutes to propagate - not an error |
| 8. Manage | Session-scoped status query and destroy | See "Destroy Rules" below |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed c04f21c397b5
- 2d ago Changed · +4 lines edc8ddddf54b
- 4d ago First seen · 94 lines · 234 tokens per session scan A d6702d17c608
huawei-iac is a skill published in the GitHub repository huaweicloud/huaweicloud-devkit (47 stars, last pushed today), licensed Apache-2.0. It adds 234 tokens to every session and 3,837 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
fastapi
Use when building, reviewing, testing, securing or shipping a FastAPI / async Python service — routers, Pydantic v2 schemas, dependency injection, async SQLAlchemy 2.0, OAuth2/JWT, ASGITransport tests, production wiring. NOT language-level Python or packaging (that is python), NOT engine-level SQL (that is…
aws-essentials
Use when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or scoping an IAM policy to least privilege. NOT the CI pipeline that ships the container (that is deployment), NOT app-code access-control…
fly-io
Use when deploying or operating an app on Fly.io — writing fly.toml, placing Machines in regions near users, attaching Volumes, managing secrets, or picking a scaling lever (autostop/autostart, scale count, fly-replay). NOT choosing which host to deploy on (that is deployment), NOT a git-push PaaS with no regions…
netlify
Use when deploying or operating a site on Netlify — writing or fixing netlify.toml, authoring Functions or Edge Functions, redirects, rewrites and headers, env vars per deploy context, and shipping via the Netlify CLI. NOT deploying to Vercel (that is vercel).
frontmcp-deployment
Use when deploying, building for production, packaging, or shipping a FrontMCP server. Covers build targets (node, cli SEA binary, browser, embeddable SDK, mcpb archive for Claude Desktop, serverless) and deploying to Vercel (with Vercel KV), AWS Lambda (API Gateway, SAM, CDK), Cloudflare Workers (KV, D1, Durable…
huawei-cloud-solution-ops
A skill for Huawei Cloud solution operations. It helps agents inspect, plan, operate, troubleshoot, and verify Huawei Cloud resources through hcloud, Huawei Cloud SDKs, Terraform, and MaaS capabilities. Use this when users want to query or change Huawei Cloud resources, troubleshoot authentication and API issues…