Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-maas-tokens-usagegit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-maas-tokens-usage)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-maas-tokens-usage"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-maas-tokens-usage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-maas-tokens-usage"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-maas-tokens-usage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00239 | $0.04890 |
| Opus 5 | $0.00120 | $0.02445 |
| Sonnet 5 | $0.00048 | $0.00978 |
| Haiku 4.5 | $0.00024 | $0.00489 |
Grade C, and why
huawei-cloud-maas-tokens-usage scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
5. **1e. POST ShowStatistics** — `requests.post("https://modelarts.{region}.myhuaweicloud.com/v1/{project_id}/maas/monitoring/show-statistics", headers=signed_headers, data=body_bytes)` Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
> 1. **Stop immediately** — Do not execute any commands Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
5. **1e. POST ShowStatistics** — `requests.post("https://modelarts.{region}.myhuaweicloud.com/v1/{project_id}/maas/monitoring/show-statistics", headers=signed_headers, data=body_bytes)` How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huawei Cloud MaaS Tokens Usage Monitoring Skill
Overview
Query Huawei Cloud MaaS (Model as a Service) usage statistics via the ShowStatistics API, including total tokens, prompt tokens, completion tokens, total requests, and total errors. Supports querying last 7 days, 14 days, 30 days, or custom time ranges. Default query type is MaaS preset service. AK/SK never leaves Python process memory.
Tool separation principle:
- Python SDK signing — AK/SK signing via
huaweicloudsdkcore.signer.Signer(credentials never leave Python process memory, never appear inps -ef) - Python requests — HTTP POST to MaaS ShowStatistics endpoint (signed request sent from Python process only)
- No hcloud CLI — MaaS ShowStatistics is not covered by KooCLI; pure Python REST + SDK signing
Security architecture:
- AK/SK is read from environment variables (
HW_ACCESS_KEY/HW_SECRET_KEY) or a credentials file by the Python script (never typed by user in conversation, never passed via CLI args, never exported to shell) - Temporary credentials add
HW_SECURITY_TOKEN(passed asX-Security-Tokenheader by the SDK signer) - Signing is performed by
huaweicloudsdkcore.Signerinside the Python process; the signed Authorization header is sent to the MaaS endpoint only - AK/SK is never printed, never logged, never appears in
ps -ef, never appears in conversation - No KMS dependency, no hcloud CLI dependency, no third-party skill dependency
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids the following operations, regardless of user requests:
| Prohibited Operation | Reason |
|---|---|
| ❌ Ask the user to provide AK/SK directly in the conversation | Credentials must never appear in conversation |
| ❌ Accept AK/SK directly provided by the user in the conversation | Credentials must never appear in conversation |
| ❌ Hardcode AK/SK in scripts or command-line arguments | Credential exposure risk |
❌ Use hcloud configure set to pass plaintext AK/SK values |
Credentials recorded in command history |
| ❌ Print or log the AK/SK values in any output | Credentials must only exist in Python process memory |
| ❌ Export AK/SK to shell variables or stdout via the script | Credentials must stay in Python process; only statistics result is printed |
| ❌ Implement SDK-HMAC-SHA256 signing manually | Error-prone; must use huaweicloudsdkcore.Signer |
❌ Use service_type=3 for Custom Endpoint |
API only supports [1, 2, 4]; returns 400 error |
❌ Hardcode timezone as CST or Asia/Shanghai |
Must auto-detect OS local timezone |
| ❌ Query a time range exceeding 30 days without segmentation | API retains only 30 days; script must auto-segment |
❌ Use a region other than cn-southwest-2 |
MaaS ShowStatistics only supports Southwest-Guiyang-1 |
❌ Write a new query script instead of using maas_rest_usage_stats.py |
Must use the script in scripts/ directory |
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/acceptance-criteria.md 5.5 KB
- references/cli-installation-guide.md 4.0 KB
- references/iam-policies.md 2.3 KB
- references/maas-metrics.md 2.1 KB
- references/related-apis.md 3.3 KB
- references/security-design.md 3.5 KB
- references/task-query-tokens-usage.md 7.2 KB
- references/troubleshooting.md 5.5 KB
- references/verification-method.md 4.4 KB
- scripts/maas_rest_usage_stats.py 9.9 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +177 lines scan B → C 6a811359845e
- 12d ago First seen · 118 lines · 239 tokens per session scan B f96f5b0e2722
huawei-cloud-maas-tokens-usage is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (49 stars, last pushed yesterday), licensed MIT. It adds 239 tokens to every session and 4,890 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it C with 3 findings (sends data to an external url, unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-maas
Debug and fix OpenShift AI Models-as-a-Service (MaaS) issues — stuck tenants, DSC conditions, bootstrap loops, missing DBs, CrashLoopBackOff pods, HTTPRoute gateway failures, leader election crashes.
deploy-maas-model
Deploy a model to Models-as-a-Service (MaaS) on OpenShift AI — creates MaaSSubscription, MaaSAuthPolicy, and an API key, then verifies access via the MaaS gateway.
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.