Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-kubectl-cce-installergit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-kubectl-cce-installer)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-kubectl-cce-installer"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-kubectl-cce-installer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-kubectl-cce-installer"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-kubectl-cce-installer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 44 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 198 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 218 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Privilege Escalation · line 89 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Excessive Agency · line 136 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02820 |
| Opus 5 | $0.00037 | $0.01410 |
| Sonnet 5 | $0.00015 | $0.00564 |
| Haiku 4.5 | $0.00007 | $0.00282 |
Grade B, and why
huawei-cloud-kubectl-cce-installer scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo bash scripts/install_kubectl_cce.sh --execute --bin-dir /usr/local/bin Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Bash, `curl`, `tar`, `cp`, and `chmod` for Linux/macOS installation How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huawei Cloud CCE kubectl Installer
Overview
Install and verify the local kubectl and kubectl-cce prerequisites used for Huawei Cloud CCE Kubernetes resource access. This skill changes only the local machine; it never creates, updates, or deletes cloud or Kubernetes resources.
Architecture: scripts/install_kubectl_cce.sh -> local OS package paths and official download/source repositories -> kubectl and kubectl-cce binaries -> kubectl plugin list verification.
Execution Method: Run the bundled shell script only. Do not replace its download URLs, build tags, installation paths, or verification steps with ad hoc commands unless the user explicitly asks for a different method.
Capabilities:
- Detect the local OS, architecture, executable availability, and plugin discovery state
- Show a no-change installation plan before execution
- Select the latest missing Linux
kubectlpackage from Huawei Cloud OBS for the local architecture - Fall back to the official Kubernetes stable release, then build the same stable tag when download fails
- Install
kubectl-ccev0.1.0 from its Gitee Release on Linux when available - Build the fixed
kubectl-ccev0.1.0 source tag when a Release asset is unavailable or download fails - Verify
kubectlandkubectl-cceplugin discovery after installation
Typical Use Cases:
- "Install kubectl and kubectl-cce on this machine"
- "Check whether kubectl-cce is available"
- "Show the installation plan for CCE kubectl access"
- "Repair a missing kubectl-cce plugin"
Prerequisites
1. Runtime Dependencies
- Bash,
curl,tar,cp, andchmodfor Linux/macOS installation gitand Go only when source-build fallback is needed- Write access to the selected
--bin-dir;/usr/local/binnormally requires elevation - Internet access to Kubernetes and Gitee release/source endpoints
- Network steps use timeouts by default: 10 seconds to connect, 300 seconds to download, 600 seconds to clone sources, and 900 seconds to build sources
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 228 lines · 75 tokens per session scan B 5096be72c5f7
huawei-cloud-kubectl-cce-installer is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (49 stars, last pushed yesterday), licensed MIT. It adds 75 tokens to every session and 2,820 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
k8s-pod-rightsizer
Analyze Kubernetes workload metrics and produce policy-constrained CPU/memory rightsizing recommendations with optional patch generation and rollback-safe apply.
k8s-cost-visibility
Estimate Kubernetes infrastructure costs by querying cluster node, pod, PVC/PV, and LoadBalancer data, applying cloud pricing models, and producing cost attribution reports with storage and LoadBalancer cost tracking, grouped by namespace, workload, node, label, or annotation.
kubectl-basics
A guide to kubectl, the command-line tool used to manage Kubernetes clusters, which run containerized applications.
troubleshoot-sandbox
Troubleshoot OpenSandbox issues by running diagnostics (logs, inspect, events, summary) via CLI or HTTP API to diagnose sandbox failures like OOM, crash, image pull errors, network problems, etc.
network-rca
Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect…
vllm-sr
Install, configure, validate, operate, evaluate, and improve vLLM Semantic Router through its CLI and Router API. Use when an agent should manage vLLM SR without depending on the Dashboard.