Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-publish-work-to-gallerygit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00149 | $0.05212 |
| Opus 5 | $0.00075 | $0.02606 |
| Sonnet 5 | $0.00030 | $0.01042 |
| Haiku 4.5 | $0.00015 | $0.00521 |
Grade C, and why
huawei-cloud-publish-work-to-gallery scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
2. **凭证排查**：`node <skill>/scripts/ensure-gitcode-credential.mjs`——自动检测本机 GitCode 凭证（`git credential fill`/`~/.git-credentials`/`$GITCODE_TOKEN`/`cmdkey`），无凭证时按平台给可行路径（Linux 提示手动配置 / Windows 检测 `gitcode-oauth` skill 并输出安装 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **核对内容**：`curl -sf --max-time 3 http://localhost:<port>` 首 100 字符须匹配本项目（`<title>`/项目名），`Index of /`/404 → 清进程重启。 How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish Work to Gallery
发布作品至华为云高校运营平台。确定性子任务优先调用内置脚本（单入口、fail-fast、自带 --help），stdout/退出码即判定依据。脚本报错才查 references/troubleshooting.md。
Pipeline
Step 1 (workDir, domainID, STS)
Step 2 (port→变量, envUrl→变量) ← 依赖 Step 1
├── Step 3 (gitUrl, gitBranch, workName) ← 只依赖 workDir
├── Step 5 (introduction, camps) ← 只依赖 workDir + STS
├── Step 4 (coverImage) ← 依赖 port + workName
└── Step 6 (detailZip) ← 依赖 workName + 代码分析
Step 7 (trainingCampId) ← 依赖 Step 5 camps
Step 8 (publish) ← 依赖以上全部
并行（Step 2 完成后）：Step 3/4/5/6 互不依赖，四者全并行（取最长路径 Step 4 ~90s，而非串行 ~160s）。Step 4 内 preflight + ensure-utf8 再并行。
变量贯穿：port/workName/envUrl 在最早步骤确定后作为变量传递全流程，禁止硬编码（隧道 URL 含 port，换端口时 envUrl 随之变）。
执行模型：① 脚本契约优先——按 stdout 成功信号判定，成功路径零源码读取；失败才 脚本提示 → troubleshooting 对应节 → grep 脚本源码 逐级查 ② 禁止手工绕过门禁（publish-work.mjs 内置 verifyGates() 复核）③ 网络超时统一 3s ④ detect-env.mjs 确定平台后只读对应平台 reference（按目录跳转，不全读）⑤ 合并无依赖的 bash 调用：用 ; 串联进一条命令，减少工具往返（每次 ~1-2s）。
脚本契约速查
| 步骤 | 脚本/命令 | 成功信号（exit 0 且） | 失败（exit 1；2=参数错） |
|---|---|---|---|
| 前置 | api.mjs GET /v1/gallery/announcements/current --prefix open-api-guest |
stdout 首行 #status=200 |
超时/拒连 → 提示排查网络 |
| 前置 | node <skill>/scripts/check-version.mjs（自动读自身 version + 请求远端版本，内部解析，stdout 仅状态行） |
exit 0 且首行 status=ok/status=skip |
exit 1（首行 status=outdated + 平台下发升级文案）→ 原样提示用户升级，停止发布 |
| 5/7 | api.mjs GET "/v1/gallery/camps" --creds-file <json> --fields "id,name,school,status,startsAt,endsAt" |
#status=200（--fields 投影减 token） |
401 → 刷新 STS |
| 1 | scan-projects.mjs |
stdout #project <n> <path> <type> |
exit 1=无候选 |
| 1 | resolve-domain.mjs [--hcloud <exe>] |
stdout #domain=<id> name=<name> |
exit 1=hcloud 失败（stderr 含排查指引） |
| 1 | gen_sts.py --account <id> |
写 sts-creds.json（含 _refresh）+sts-creds.sh |
见 [troubleshooting#domain-id-resolution-issues] |
| 3 | strip-git-credential.mjs "<rawUrl>" |
stdout=安全 URL（https:// 开头、.git 结尾、无 @） |
@/非 https/非 .git → 停止发布 |
| 3 | ensure-gitcode-credential.mjs |
#credential=found 或 #credential=missing（exit 0） |
exit 1=Windows 无凭证且 skill 未装（stderr 含安装命令） |
| 3 | extract-workname.mjs <workDir> |
stdout #name=<name> source=<来源> |
exit 1=workDir 不存在 |
| 4 | preflight.sh / preflight.ps1 |
写 font-gate-ok（ok=true gate=preflight） |
截图/封面/图表禁止 |
| 4 | ensure-utf8.mjs <dir> |
写 utf8-gate-ok |
编码非 UTF-8 → 禁止截图 |
| 4 | build-cover.mjs --url … --project-dir … --title … --out … |
stdout 一行 #cover=… layout=… multi=… |
exit 1 → 截图/校验/合成任一失败，stderr 详情 |
| 4 | screenshot_guard.py http://… --out <png> --quiet |
写 screenshot-gate-ok + 出 PNG |
字形/字符集不过 → 修字体重试 |
| 4 | generate_cover.py --screenshot … --title … --out … |
封面 PNG，再过 verify-glyphs.py |
exit 1 → 禁止继续合成 |
| 4/6 | verify-glyphs.py <img> --quiet |
exit 0（stdout 仅 1 行省 token） | exit 1 → 疑似豆腐块 → 修字体 |
| 5 | count-cjk.mjs --file <utf8.txt> |
总字符数 15~50 | exit 1 → 改写简介再计 |
| 6 | generate_diagram.py --html … --out … |
图表 PNG，再过 verify-glyphs.py --quiet |
同封面 |
| 6 | build-detail-zip.mjs --readme <md> --resources <dir> --out <zip> |
打包+校验一步完成 | exit 1 → 按输出修复重打 |
| 8 | check-gates.mjs --cover <png> --detail <zip> --strict --max-age 3600 --quiet |
exit 0（stdout 仅 1 行省 token） | exit 1 → 回退重跑门禁 |
| 8 | publish-work.mjs <utf8-params.json> |
#status=201（仅输出 workId/workUrl/reward） |
409/其他；失败时原样输出完整响应 |
What ships with it
37 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/api-spec.md 19 KB
- references/codearts-sandbox.md 1.7 KB
- references/devbridge-tunnel.md 3.8 KB
- references/error-codes.md 5.3 KB
- references/mock-server-template.md 4.1 KB
- references/self-verify-publish.md 6.0 KB
- references/troubleshooting.md 32 KB
- references/windows-setup.md 7.7 KB
- references/work-preparation-linux.md 15 KB
- references/work-preparation-windows.md 8.8 KB
- references/work-preparation.md 44 KB
- scripts/api.mjs 17 KB runs code
- scripts/browser_launch.py 1.2 KB runs code
- scripts/build-cover.mjs 14 KB runs code
- scripts/build-detail-zip.mjs 6.5 KB runs code
- scripts/check-gates.mjs 10.0 KB runs code
- scripts/check-version.mjs 3.6 KB runs code
- scripts/count-cjk.mjs 4.7 KB runs code
- scripts/detect-env.mjs 2.0 KB runs code
- scripts/download-noto-color-emoji.sh 7.0 KB runs code
- scripts/ensure-gitcode-credential.mjs 4.8 KB runs code
- scripts/ensure-utf8.mjs 8.8 KB runs code
- scripts/extract-fonts.mjs 2.5 KB runs code
- scripts/extract-workname.mjs 4.5 KB runs code
- scripts/gen_sts.py 4.8 KB runs code
- scripts/generate_cover.py 39 KB runs code
- scripts/generate_diagram.py 6.4 KB runs code
- scripts/preflight.ps1 7.7 KB runs code
- scripts/preflight.sh 33 KB runs code
- scripts/publish-work.mjs 9.1 KB runs code
- scripts/resolve-domain.mjs 4.6 KB runs code
- scripts/scan-projects.mjs 5.1 KB runs code
- scripts/screenshot_guard.py 14 KB runs code
- scripts/shot_app.py 1.5 KB runs code
- scripts/strip-git-credential.mjs 2.5 KB runs code
- scripts/validate-detail-zip.mjs 6.0 KB runs code
- scripts/verify-glyphs.py 23 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 213 lines · 149 tokens per session scan C 9761666b4585
huawei-cloud-publish-work-to-gallery is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (49 stars, last pushed yesterday), licensed MIT. It adds 149 tokens to every session and 5,212 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-10.
Other skills, from other repositories
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
story-readiness
Validate that a story file is implementation-ready. Checks for embedded GDD requirements, ADR references, engine notes, clear acceptance criteria, and no open design questions. Produces READY / NEEDS WORK / BLOCKED verdict with specific gaps. Use when user says 'is this story ready', 'can I start on this story', 'is…
projects
List all managed projects with status, branch, open PRs, and open issue counts — portfolio-level view.
magpie-security-issue-import-from-md
Open one or more tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the Needs triage board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect.