Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-sms-migration-assistantgit clone --depth 1 https://github.com/huaweicloud/huaweicloud-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-sms-migration-assistant)<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-sms-migration-assistant"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-sms-migration-assistant/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huaweicloud/huaweicloud-skills/huawei-cloud-sms-migration-assistant"><img src="https://agentmods.dev/badge/skills/huaweicloud/huaweicloud-skills/huawei-cloud-sms-migration-assistant.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.05655 |
| Opus 5.5 | $0.00036 | $0.02262 |
| Sonnet 5.5 | $0.00018 | $0.01131 |
| Haiku 4.5 | $0.00009 | $0.00566 |
Grade C, and why
huawei-cloud-sms-migration-assistant scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
**`target_password` 的真相**：该参数设置 SMS 创建中间 ECS 时的密码。但全盘迁移完成后，源盘的 `/etc/shadow` 会覆盖中间 ECS 的密码 — **最终迁移盘上的密码是源端的，不是 `target_password` 设的值**。因此必须在迁移后修复脚本中重新设置密码（见第七节修复项 6）。 How it starts
The opening of the file, as written. The whole thing — 436 lines — stays where its author put it; the contents beside it link to each section on GitHub.
huawei-cloud-sms-migration-assistant
概述
辅助华为云 SMS（Server Migration Service）主机迁移操作。 主要步骤如下：
-
高危操作禁止列表 — 牢记迁移过程中绝对不能执行的操作
-
迁移前检查 — 网络连通性、源端资源水位、磁盘/OS 兼容性
-
API 迁移流程 — hcloud CLI + SMS API 完整流程
-
迁移后启动修复 — 如果源端使用UEFI，需要使用helper ecs把内核替换成BIOS、网络配置、密码注入
-
迁移后校验 — 目的端与源端一致性比对
-
常见错误与修复 — 实战踩坑（SMS.0515/SMS.0007/SMS.6562 等） 如果迁移中遇到报错，首先参考
references/MIGRATION_REFERENCE.md错误目录，以及解决方案
核心原则
在不修改任何源端信息的情况下，将源端数据原封不动地安全复制到目的端。
- 源端保护第一 — 源端严格只读，禁止任何增删改
- 数据完整性 — 源端所有数据完整复制到目的端
- 严格按输入创建目的端 — 不允许偏差或改动
- 源端业务不变 — 迁移过程中源端业务状态保持不变
- 命名规则强制 — 所有新创建的目的端 ECS 必须按
{hostname}_{MMDD}命名
最关键风险点：源端保护
迁移过程中，源端必须严格只读。任何增删改操作都会导致致命后果。
- 禁止：数据库写入、文件上传/修改/删除、日志清空/新增、配置变更、应用重启、软件安装、用户添加/修改、权限变更、磁盘分区调整
- 后果：源端业务瘫痪 + 迁移失败 + 目的端数据不一致 + 无法恢复
- Agent 必须：定期检查源端磁盘/数据库/日志大小，发现任何变化立即停止迁移、回滚、通知用户
一、禁止执行的高危操作
级别一：数据丢失或迁移失败（绝对禁止）
源端保护
| 编号 | 禁止操作 |
|---|---|
| 01 | 迁移中对源端任何增删改 |
| 02 | 迁移中源端磁盘调整 |
| 03 | 关闭源端 SMS-Agent |
| 04 | 关闭源端 IO 监控 |
| 05 | 割接后源端新增数据 |
目的端保护
| 编号 | 禁止操作 |
|---|---|
| 06 | 目的端切换操作系统 |
| 07 | 目的端重装系统 |
| 08 | 目的端磁盘操作 |
| 09 | 未完成时系统重装/切换 |
| 10 | 割接前目的端新增数据 |
其他关键操作
| 编号 | 禁止操作 |
|---|---|
| 11 | 未完成时删除迁移任务 |
| 12 | 禁止创建/新建 EIP（任何阶段），需 EIP 时用户在控制台手动创建，你只用已有 EIP。例外：迁移后修复流程中创建 helper ECS 的临时 EIP 允许由 Agent 创建，修复完成后必须立即释放 |
| 12a | 网络类型非 EIP（VPN/专线）时禁止新建 EIP、禁止给目的端 ECS 挂载/绑定 EIP；模板中禁止传入任何 --template.publicip.* 参数；迁移后必须检查并释放 SMS 自动创建的 EIP |
| 13 | 禁止对你在的主机里记录的华为云AK/SK 做增删改操作 |
级别二：迁移问题或额外成本
| 编号 | 禁止操作 |
|---|---|
| 14 | CPU 占用率 ≥ 80% 启动迁移 |
| 15 | 可用内存 ≤ 256MB 启动迁移 |
| 16 | 磁盘 > 23 块 |
| 17 | Linux 磁盘 > 16TB |
| 18 | 同时迁移 > 200 台 |
| 19 | 单用户 > 1000 台 |
| 20 | BitLocker 加密 Windows |
| 21 | AD 域控制器/多节点数据库 |
| 22 | RAID 磁盘阵列 |
| 23 | LVM 嵌套系统 |
| 24 | LVM 精简卷 |
| 25 | 安全组开放 0.0.0.0/0 |
| 26 | 安全组开放非必需端口 |
| 27 | 使用私有镜像而非公有镜像 |
| 28 | 目的端规格 < 源端（缩容） |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago First seen · 436 lines · 91 tokens per session scan C 09179444d3b6
huawei-cloud-sms-migration-assistant is a skill published in the GitHub repository huaweicloud/huaweicloud-skills (59 stars, last pushed yesterday), licensed MIT. It adds 91 tokens to every session and 5,655 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-30.
Other skills, from other repositories
gke-compute-classes
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…
gke-workload-security
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (auditcluster.sh), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (gVisor), enforcing Pod…
gke-reliability
Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE health probes (liveness, readiness, startup). Don't use for generating K8s YAML manifests (use gke-manifest-generation) or disaster recovery…
cloud-architect
Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost…
nemo-automodel-launcher-config
Configure NeMo AutoModel job launches for interactive runs, Slurm clusters, and SkyPilot cloud execution.
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".