Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/huaweicloud/huaweicloud-devkitnpx agentmods add skills/huaweicloud/huaweicloud-devkit/huawei-sandboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-sandbox)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-sandbox"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-devkit/huawei-sandbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-devkit/huawei-sandbox"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-devkit/huawei-sandbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.12141 |
| Opus 5.5 | $0.00055 | $0.04856 |
| Sonnet 5.5 | $0.00027 | $0.02428 |
| Haiku 4.5 | $0.00014 | $0.01214 |
Grade B, and why
huawei-sandbox scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo rm -f /etc/nginx/conf.d/*.conf /etc/nginx/conf.d/*.conf.bak 2>/dev/null Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
| Destructive commands blocked | `rm -rf /`, `mkfs`, `dd if=`, fork bombs are denied by safety policy | Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `curl`, health checks, quick tests | Either — `exec_one_shot` preferred | Stateless, fast | How it starts
The opening of the file, as written. The whole thing — 843 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huawei Cloud Sandbox
STOP - Do not answer from general knowledge. Follow the procedure below.
Overview
Domain expertise for Huawei Cloud Sandbox (DevStation) instances and workspace terminal execution. Covers sandbox lifecycle via hdkitservice API and remote terminal command execution via hwlink protocol.
Activation
- Proactive offering: when the developer's task needs a temporary runtime (e.g. "deploy this web app", "run this app and preview it"), offer the sandbox proactively — the developer never has to say "use sandbox". Prompt: "This task can be satisfied by a sandbox — use it?"
- Static website hosting — present options, sandbox first: when the developer asks to deploy/host/publish a static website or web app without naming a target, do NOT silently pick a service. Present the target options in this order: ① 沙箱 (recommended — temporary runtime, instant preview URL) ② OBS 静态托管 (long-term static hosting/CDN) ③ ECS ④ CCE, then follow the developer's choice. Recommended prompt: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选择 OBS 静态托管、ECS 或 CCE，你想部署到哪里？" If the developer has no preference, proceed with the sandbox.
- Detect web apps in deploy-a-repo prompts: prompts like "部署 GitHub - /" or "deploy " do not say "web app". Clone or inspect the repository first (package.json with dev/serve/build scripts, index.html, frontend framework dependencies such as vue/react/angular/vite, static sites, Dockerfile running a web server). If it is a web application, offer the sandbox first: "检测到该项目是 Web 应用，建议优先使用沙箱部署（临时运行环境，可预览访问），是否使用？"
- Clone into the sandbox workspace directory: always put project code under
/workspace/<repo-name>(create the directory if missing) —/workspaceis the sandbox's dedicated workspace mount at the filesystem root, not$HOME/workspace. Never use/tmpor other ephemeral locations. This keeps the project with the sandbox session, is easy to reference for serving/exposing, and survives session-level restarts of the shell. - Deployment must end with a public URL: after deploying and exposing the app with DevBridge, always return the tunnel URL to the developer as the final result — a deployment without an accessible link is incomplete.
- Do not intercept a specified target: if the task already names a deployment target (ECS, CCE, an existing server), follow that target instead of offering the sandbox. Offer the sandbox only when the task needs a temporary runtime or no target is specified.
- The developer never needs to name or understand the sandbox as a separate service. Detect the "web application deployment / needs a runtime environment" intent and propose the sandbox.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +1 lines 038b417aeb2c
- 1mo ago Changed · +9 lines 5382699b6bfd
- 1mo ago Changed · +25 lines scan C → B dbefbc0a5bdb
- 2mo ago Changed · +587 lines 3479277d47cc
- 2mo ago First seen · 221 lines · 137 tokens per session scan C d1698d33bc35
huawei-sandbox is a skill published in the GitHub repository huaweicloud/huaweicloud-devkit (70 stars, last pushed 3d ago), licensed Apache-2.0. It adds 137 tokens to every session and 12,141 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
huawei-sandbox compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| huawei-sandboxhuaweicloud/huaweicloud-devkit | Skill | 70 | 3d ago | Apache-2.0 | B | 137 | Claude Code, Codex |
| fastapiericrisco/rsc-harness | Skill | 555 | 5d ago | MIT | A | 94 | Claude Code, Codex |
| aws-essentialsericrisco/rsc-harness | Skill | 555 | 5d ago | MIT | A | 89 | Claude Code, Codex |
| fly-ioericrisco/rsc-harness | Skill | 555 | 5d ago | MIT | A | 87 | Claude Code, Codex |
| netlifyericrisco/rsc-harness | Skill | 555 | 5d ago | MIT | A | 63 | Claude Code, Codex |
| frontmcp-deploymentagentfront/frontmcp | Skill | 148 | yesterday | Apache-2.0 | A | 244 | Claude Code, Codex |
| huawei-cloud-solution-opshuaweicloud/huaweicloud-skills | Skill | 59 | 2d ago | MIT | A | 81 | Claude Code, Codex |