Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-cce-kubernetes-event-analyzergit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-cce-kubernetes-event-analyzer)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-cce-kubernetes-event-analyzer"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-cce-kubernetes-event-analyzer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-cce-kubernetes-event-analyzer"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-cce-kubernetes-event-analyzer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 13 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 13 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 15 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 23 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 41 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 48 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 53 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 55 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 73 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 94 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 104 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 128 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 193 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 267 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.03808 |
| Opus 5 | $0.00034 | $0.01904 |
| Sonnet 5 | $0.00014 | $0.00762 |
| Haiku 4.5 | $0.00007 | $0.00381 |
Grade A, and why
huawei-cloud-cce-kubernetes-event-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huawei Cloud CCE Kubernetes Event Analyzer
Overview
Query and analyze Kubernetes Events in Huawei Cloud CCE clusters to identify warnings, repeated failure patterns, affected resources, and useful diagnosis handoffs. The skill supports a current Event view through kubectl and a historical Event view through LTS.
Architecture: python3 scripts/huawei-cloud.py dispatcher -> kubectl through external kubeconfig or kubectl cce for current Events / kubectl cce LogConfig discovery plus hcloud LTS ListLogs for historical Events -> filtering and grouping -> diagnosis handoff.
Execution Method: Invoke only the bundled dispatcher. Do not query Kubernetes Events with raw Python Kubernetes SDK calls, direct Kubernetes API calls, or ad hoc cloud commands. The huawei_get_cce_events implementation invokes kubectl internally: external kubeconfig access first, then the kubectl cce plugin fallback.
Related Skills:
huawei-cloud-kubectl-cce-installer- Installkubectland thekubectl-cceplugin required for cluster accesshuawei-cloud-cce-metric-analyzer- CCE and cloud-resource metrics
Capabilities:
- Query current Kubernetes Events across a cluster or in a namespace
- Read Events through external
kubectlkubeconfig access orkubectl cce - Query historical Event records from LTS within an explicit time window
- Filter and group Events by type, reason, namespace, resource, and timestamps
- Check the current status of supported resources referenced by Events
- Analyze a supplied current or historical Event result locally without another cloud request
- Identify repeated warning patterns and hand off evidence to diagnosis skills
Typical Use Cases:
- "List Warning events for this CCE cluster"
- "Find repeated FailedScheduling events in namespace default"
- "Query historical ImagePullBackOff events from LTS"
- "Analyze the top Kubernetes event reasons during an incident"
Prerequisites
1. Runtime Dependencies
- Python 3.8+ for the dispatcher and result processing
hcloud(KooCLI) for cluster lookup and temporary external kubeconfig generationkubectlfor current Event readskubectl-ccewhen the cluster has no usable external endpoint; see kubectl-cce.mdhcloudLTS command support and the Cloud Native Log Collection add-on (log-agent) with adefault-eventEvent-to-LTSLogConfig.huawei_query_k8s_events_from_ltsreadslogconfigs.logging.openvessel.iothroughkubectl cce, then invokeshcloud LTS ListLogsusing the configured LTS IDs.
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/acceptance-criteria.md 1.2 KB
- references/kubectl-cce.md 1.3 KB
- references/output-schema.md 2.9 KB
- references/risk-rules.md 2.9 KB
- references/workflow.md 3.0 KB
- scripts/huawei_cloud/__init__.py 37 B runs code
- scripts/huawei_cloud/cce_app_logs.py 1.7 KB runs code
- scripts/huawei_cloud/cce_events_lts.py 12 KB runs code
- scripts/huawei_cloud/cce.py 2.4 KB runs code
- scripts/huawei_cloud/common.py 2.0 KB runs code
- scripts/huawei_cloud/dispatcher.py 1.8 KB runs code
- scripts/huawei_cloud/event_analysis.py 8.8 KB runs code
- scripts/huawei_cloud/kubectl_client.py 11 KB runs code
- scripts/huawei_cloud/lts.py 4.0 KB runs code
- scripts/huawei_cloud/resource_status.py 6.2 KB runs code
- scripts/huawei-cloud.py 1.7 KB runs code
- skill-profile.yaml 682 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 291 lines · 68 tokens per session scan A b0df345d4529
huawei-cloud-cce-kubernetes-event-analyzer is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (49 stars, last pushed yesterday), licensed MIT. It adds 68 tokens to every session and 3,808 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
k8s-incident-triage
Read-only Kubernetes incident triage using kubectl. Accepts natural language or structured input. Produces root-cause hypotheses, evidence, and next-step commands.
kubestellar-console
Multi-cluster Kubernetes dashboard with AI-powered operations via MCP server and 10+ built-in agent skills.
networkpolicy-debug
Diagnose NetworkPolicy-related connectivity issues (traffic unexpectedly blocked, default-deny effects, egress blocking DNS). Identifies which NetworkPolicies affect a pod, checks ingress/egress rules, and verifies CNI support.
statefulset-debug
Diagnose StatefulSet rollout and scaling failures (ordered update stuck, OnDelete not updating, partition misconfiguration, PVC binding deadlocks). Checks update strategy, pod ordinal progression, PVC bindings, and ordered startup to identify why a StatefulSet is not progressing.
image-pull-debug
Diagnose container image pull failures (ErrImagePull / ImagePullBackOff). Checks pod status, containerd logs, and events to identify root cause.
pod-pending-debug
Diagnose pod scheduling failures (Pending, Unschedulable). Checks events, node resources, taints, affinity, and PVC bindings to identify why a pod cannot be scheduled.