Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-publish-work-to-gallerygit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-publish-work-to-gallery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00200 | $0.07970 |
| Opus 5.5 | $0.00080 | $0.03188 |
| Sonnet 5.5 | $0.00040 | $0.01594 |
| Haiku 4.5 | $0.00020 | $0.00797 |
Grade C, and why
huawei-cloud-publish-work-to-gallery scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- **截图临时目录 `tmp=<abs>` 保留到整体流程结束**(供 Step 8 409 改名复用原截图,见下),**由 Step 8 发布成功/放弃后统一清理**(`Remove-Item -Recurse -Force <abs>` 或 `rm -rf <abs>`),build-cover 不删。 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **启动项目**:`$SKILL_DIR/scripts/spawn-detached.mjs --out /tmp/spawn.out --pidfile /tmp/app.pid --cwd /path/to/project -- npm run dev` → `#spawn=ok pid=12345`。**必须传 `--cwd <workDir>`**(脚本默认用 `process.cwd()`,若执行目录非 workDir, How it starts
The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish Work to Gallery
发布作品至华为云高校运营平台。优先调用内置脚本(单入口、fail-fast、自带 --help),报错才查 references/troubleshooting.md。
Pipeline
Step 1 (workDir, domainID, STS)
Step 2 (port→变量, envUrl→变量) ← 依赖 Step 1
├── Step 3 (gitUrl, gitBranch, workName) ← 只依赖 workDir
├── Step 5 (introduction, camps) ← 只依赖 workDir + STS
├── Step 4 (coverImage) ← 依赖 port + workName
└── Step 6 (detailZip) ← 依赖 workName + 代码分析
Step 7 (trainingCampId) ← 依赖 Step 5 camps
Step 8 (publish) ← 依赖以上全部
并行(Step 2 完成后):Step 3/4/5/6 互不依赖,四者全并行(取最长路径 Step 4 ~90s,而非串行 160s)。Step 4 内 10 分钟)——脚本已内置门禁:缺 preflight + ensure-utf8 再并行。注意 Step 6 的隐性依赖:generate_diagram.py 用 Playwright,由 Step 4 的 preflight 安装(首次含 CJK 字体 + Chromium,5font-gate-ok 标记时 exit 1 提示等待,不报 ModuleNotFoundError。并行跑 Step 6 收到该提示 → 等 preflight(轮询日志/标记)完成后再重跑本步,不是真失败。
变量贯穿:port/workName/envUrl 在最早步骤确定后作为变量传递全流程,禁止硬编码(隧道 URL 含 port,换端口时 envUrl 随之变)。
执行模型:① 脚本契约优先——按 stdout 成功信号判定,成功路径零源码读取;失败才 脚本提示 → troubleshooting 对应节 → grep 脚本源码 逐级查 ② 禁止手工绕过门禁 ③ 网络超时统一 3s ④ detect-env.mjs 确定平台后只读对应平台 reference(按目录跳转,不全读)⑤ 合并无依赖的 bash 调用:用 ; 串联进一条命令,减少工具往返(每次 ~1-2s) ⑥ 需用户交互的命令一律把链接/二维码原样展示给用户,禁止用 agent 内置浏览器/工具(browser_use_open 等)代开——脚本本地已起回调服务器,用户在任意浏览器授权后脚本自动拿到 token,agent 全程不需要浏览器。
Core Commands(脚本契约速查)
$SKILL_DIR定义:本 skill 的安装目录绝对路径(含 SKILL.md 的目录)。执行前先设置export SKILL_DIR=/path/to/huawei-cloud-publish-work-to-gallery(示例:$HOME/.local/share/huawei-cloud-publish-work-to-gallery)。所有脚本均为可执行文件(带 shebang),直接用$SKILL_DIR/scripts/…前缀调用,无需node/python/bash解释器前缀(该说法仅 Linux 成立;Windows 下 .mjs/.py 需node/python前缀、preflight.ps1需powershell前缀);若安装器未恢复可执行位(Linux 直接调用报Permission denied),先执行一次chmod +x "$SKILL_DIR/scripts/"*自愈,不改脚本;参数一律用可解析的示例值(无<…>占位符,避免命令提取器剥离后缺参/空值)。W/R 标注:W= 平台写操作(发布作品,必须经用户确认后才执行);R= 只读查询/本地辅助命令。
What ships with it
46 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/api-spec.md 21 KB
- references/codearts-sandbox.md 1.7 KB
- references/devbridge-tunnel.md 1.7 KB
- references/error-codes.md 5.3 KB
- references/iam-policies.md 3.7 KB
- references/mock-server-template.md 4.1 KB
- references/self-verify-publish.md 6.1 KB
- references/troubleshooting.md 37 KB
- references/windows-setup.md 8.7 KB
- references/work-preparation-linux.md 17 KB
- references/work-preparation-windows.md 8.8 KB
- references/work-preparation.md 45 KB
- scripts/api.mjs 18 KB runs code
- scripts/browser_launch.py 1.2 KB runs code
- scripts/build-cover.mjs 18 KB runs code
- scripts/build-detail-zip.mjs 6.5 KB runs code
- scripts/check-gates.mjs 11 KB runs code
- scripts/check-version.mjs 3.7 KB runs code
- scripts/count-cjk.mjs 4.7 KB runs code
- scripts/detect-env.mjs 2.2 KB runs code
- scripts/download-noto-color-emoji.sh 7.0 KB runs code
- scripts/ensure-git-root.mjs 2.5 KB runs code
- scripts/ensure-gitcode-credential.mjs 3.7 KB runs code
- scripts/ensure-user-bindir.mjs 6.5 KB runs code
- scripts/ensure-user-tool.mjs 9.2 KB runs code
- scripts/ensure-utf8.mjs 8.8 KB runs code
- scripts/extract-fonts.mjs 2.5 KB runs code
- scripts/extract-workname.mjs 4.5 KB runs code
- scripts/gen_sts.py 6.6 KB runs code
- scripts/generate_cover.py 63 KB runs code
- scripts/generate_diagram.py 7.5 KB runs code
- scripts/gitcode-oauth.ensure.mjs 17 KB runs code
- scripts/install-hcloud.ps1 6.4 KB runs code
- scripts/preflight.ps1 11 KB runs code
- scripts/preflight.sh 56 KB runs code
- scripts/publish-work.mjs 11 KB runs code
- scripts/read-git-info.mjs 6.2 KB runs code
- scripts/resolve-domain.mjs 6.8 KB runs code
- scripts/scan-projects.mjs 5.6 KB runs code
- scripts/screenshot_guard.py 16 KB runs code
- scripts/setup-env.sh 447 B runs code
- scripts/shot_app.py 1.6 KB runs code
- scripts/spawn-detached.mjs 3.9 KB runs code
- scripts/strip-git-credential.mjs 2.5 KB runs code
- scripts/validate-detail-zip.mjs 6.0 KB runs code
- scripts/verify-glyphs.py 32 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago Changed · +27 lines · +51 tokens per session b7a141070b49
- 1mo ago First seen · 213 lines · 149 tokens per session scan C 9761666b4585
huawei-cloud-publish-work-to-gallery is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (59 stars, last pushed yesterday), licensed MIT. It adds 200 tokens to every session and 7,970 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-10.
Other skills, from other repositories
story-readiness
Checks whether a story is ready to implement: clear acceptance criteria, no open questions, valid ADR and dependencies. Use when the user asks if a story, or the sprint's stories, are ready to start or build.
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
qa-project-bootstrap
Onboard a new QA engineer to an existing codebase, or audit an existing test architecture. Produces a 30-day ramp plan: codebase orientation, framework walkthrough, test architecture audit, mentorship pairing, and first-test guidance. Use when: "QA onboarding," "new tester," "ramp up," "test architecture audit,"…
remove
Remove a deployed framework or addon from the current workspace.