huaweicloud/huaweicloud-skills

huawei-cloud-hss-query

- Query and manage Huawei Cloud HSS (Host Security Service) for daily security inspection and incident response.

使い方

インストールコマンドをコピーし、自分の環境へ導入する前にソースを確認します。
必要なツール、認証情報、対応環境を原文で確認します。
入力と成果物を指定し、出力を資料と照合します。

npx skills add https://github.com/huaweicloud/huaweicloud-skills --skill huawei-cloud-hss-query

開始前の確認

導入にはモデル契約、API枠、ファイルへのアクセス許可は含まれません。
スター数や導入数は活動の指標であり、独立した品質・安全性試験ではありません。

リポジトリの原文

見出し、例、コード、表、リンク、参照画像を含む原文を表示しています。

Huawei Cloud HSS Host Security Skill

Overview

This skill provides AI Agent capabilities for Huawei Cloud HSS (Host Security Service / 主机安全服务), covering daily security inspection, risk diagnosis, and alert handling. It supports querying host assets, vulnerabilities, security baselines, intrusion alerts (trojans, brute-force attacks), and login audit logs, plus updating alert handling status — all via hcloud CLI.

Scope boundaries:

✅ Query: host assets, vulnerabilities, baselines, intrusion alerts, login audit logs
✅ Diagnose: risk scoring, high-risk vulnerability analysis, abnormal login analysis
✅ Manage: update alert handling status (mark as handled, ignored, etc.)
❌ Does NOT create or delete host resources
❌ Does NOT execute isolation, antivirus, or other high-risk actions
❌ Does NOT perform real-time blocking or kill processes

Prerequisites

hcloud CLI installed and authenticated with valid AK/SK credentials.

Installation guide: see references/cli-installation-guide.md
Verify: hcloud configure list shows a valid profile

HSS agent deployed on target ECS instances (HSS must be enabled in the console)
IAM permissions: HSS read permissions for query operations, HSS write permissions for alert handling.

See references/iam-policies.md for least-privilege policy

Region: HSS is region-specific. Use --cli-region to specify the target region (e.g., {your-region})

Workflow

1. Identify target → region, project_id, optional host_id filter
2. Query phase → list assets / vulnerabilities / baselines / alerts / login logs
3. Diagnose phase → risk score, high-risk items, abnormal login patterns
4. Handle phase → update alert handling status (requires user confirmation)
5. Output → structured JSON risk list + readable summary report

Core Commands

1. Host Assets (主机资产)

List all protected hosts with agent status, OS type, and risk flags:

bash

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} \
  [--host_id={host_id}] [--host_name={host_name}] [--os_type={linux|windows}] \
  [--agent_status={installed|not_installed|online|offline}] \
  [--has_vul=true] [--has_intrusion=true] [--has_baseline=true] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

Show host statistics (total hosts, protected count, risk distribution):

bash

hcloud HSS ShowHostsStatistics --cli-region={region} --project_id={project_id}

Query risk status for specific hosts:

bash

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \
  --host_id_list.1={host_id_1} [--host_id_list.2={host_id_2}]

2. Vulnerabilities (漏洞)

List all vulnerabilities with filtering by type, status, severity:

bash

hcloud HSS ListVulnerabilities --cli-region={region} --project_id={project_id} \
  [--vul_id={vul_id}] [--vul_name={vul_name}] [--cve_id={cve_id}] \
  [--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \
  [--status={vul_status}] [--handle_status={handle_status}] \
  [--repair_priority={critical|high|medium|low}] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

List vulnerabilities on a specific host:

bash

hcloud HSS ListHostVuls --cli-region={region} --project_id={project_id} \
  --host_id={host_id} [--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \
  [--limit=10] [--offset=0]

List hosts affected by a specific vulnerability:

bash

hcloud HSS ListVulHosts --cli-region={region} --project_id={project_id} \
  --type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul} --vul_id={vul_id} \
  [--limit=10] [--offset=0]

Show vulnerability details (choose by type):

bash

# Linux vulnerability
hcloud HSS ShowLinuxVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

# Windows vulnerability
hcloud HSS ShowWindowsVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

# Web-CMS vulnerability
hcloud HSS ShowCmsVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

Show vulnerability statistics:

bash

hcloud HSS ShowVulStatics --cli-region={region} --project_id={project_id}

3. Security Baselines (安全基线)

Show baseline check overview (last check time, check stats, pass rate, top risks):

bash

hcloud HSS ShowBaselineOverview --cli-region={region} --project_id={project_id}

Show baseline statistics:

bash

hcloud HSS ShowBaselineStatistic --cli-region={region} --project_id={project_id}

List hosts affected by a specific baseline check rule:

bash

hcloud HSS ListHostCheckRules --cli-region={region} --project_id={project_id} \
  --check_name={check_name} --standard={cn_standard|hw_standard} --host_id={host_id} \
  [--check_rule_name={rule_name}] [--limit=10] [--offset=0]

⚠️ --standard 为必填参数。

Show security check report for a specific host:

bash

hcloud HSS ShowSecurityCheckHostReport --cli-region={region} --project_id={project_id} \
  --host_id={host_id} --scan_time={scan_time_ms}

⚠️ --scan_time 为必填参数（毫秒级时间戳）。

Show risk configuration detail:

bash

hcloud HSS ShowRiskConfigDetail --cli-region={region} --project_id={project_id} \
  --check_name={check_name} --standard={cn_standard|hw_standard} \
  [--host_id={host_id}]

⚠️ --standard 为必填参数（cn_standard=等保合规标准，hw_standard=云安全实践标准）。

4. Intrusion Alerts — Trojan & Malware (木马/恶意软件告警)

Query alert event history with filtering by event type, severity, handling status:

bash

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \
  [--event_type={event_type}] [--event_class_ids.1={event_class_id}] \
  [--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \
  [--host_ip={ip}] [--host_name={name}] [--attack_tag={tag}] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

Common event_class_ids for malware:

eventclassid	Description
`av_1002`	Virus (病毒)
`av_1003`	Worm (蠕虫)
`av_1004`	Trojan (木马)
`av_1005`	Botnet (僵尸网络)
`av_1006`	Backdoor (后门)
`av_1010`	Rootkit
`av_1011`	Ransomware (勒索软件)
`av_1015`	Webshell
`av_1016`	Mining software (挖矿软件)

List host protection history:

bash

hcloud HSS ListHostProtectHistoryInfo --cli-region={region} --project_id={project_id} \
  --start_time={start_time_ms} --end_time={end_time_ms} [--limit=10] [--offset=0] \
  [--host_id={host_id}] [--file_path={path}]

⚠️ `--start_time` / `--end_time` 为必填参数（毫秒级时间戳，相差不超过 30 天）；--host_id 可选。

List antivirus-protected hosts:

bash

# List antivirus-protected hosts (scan_type: quick/full; start_type: now/period)
hcloud HSS ListAntiVirusHost --cli-region={region} --project_id={project_id} \
  --limit=10 --offset=0 --scan_type={quick|full} --start_type={now|period} \
  [--host_id={host_id}] [--policy_id={policy_id}]

⚠️ `--limit` / `--offset` / `--scan_type` / `--start_type` 为必填参数。 --scan_type 枚举：quick（快速扫描）/ full（全盘扫描）；--start_type 枚举：now（立即启动）/ period（周期启动）。其他值（如 all/manual/auto）会被 API 静默忽略并返回空结果。

5. Intrusion Alerts — Brute Force (暴力破解告警)

Query brute-force attack events (login0001 = attempt, login0002 = success):

bash

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \
  --event_class_ids.1=login_0001 --event_class_ids.2=login_0002 \
  [--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \
  [--host_ip={ip}] [--limit=10] [--offset=0]

List weak password detection results:

bash

hcloud HSS ListWeakPasswordUsers --cli-region={region} --project_id={project_id} \
  [--host_id={host_id}] [--limit=10] [--offset=0]

6. Login Audit Logs (登录审计日志)

Query common login IPs:

bash

hcloud HSS ListLoginCommonIp --cli-region={region} --project_id={project_id} \
  [--ip_addr={ip}]

Query common login locations:

bash

hcloud HSS ListLoginCommonLocation --cli-region={region} --project_id={project_id} \
  [--area_code={area_code}]

⚠️ 这两个操作仅支持 --ip_addr / --area_code 过滤器（实测 --host_id/--limit/--offset 不支持），不可加分页参数。

7. Risk Diagnosis (风险诊断)

Query overall risk score:

bash

hcloud HSS ShowRiskScore --cli-region={region} --project_id={project_id}

Query risk status for specific hosts:

bash

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \
  --host_id_list.1={host_id_1}

8. Update Alert Handling Status (告警处置) — ⚠️ Mutating, Requires Confirmation

Handle alert events (mark as handled, ignored, etc.):

bash

hcloud HSS ChangeEvent --cli-region={region} --project_id={project_id} \
  --operate_event_list.1.event_class_id={event_class_id} \
  --operate_event_list.1.event_id={event_id} \
  --operate_event_list.1.event_type={event_type} \
  --operate_event_list.1.occur_time={occur_time_ms} \
  --operate_type={operate_type}

⚠️ --operate_type 是顶层参数（不属于 operateeventlist 数组内）；数组中 event_class_id/event_id/event_type/occur_time 均必填。

operate_type values for ChangeEvent:

mark_as_handled — Mark as handled (标记已处理)
ignore — Ignore (忽略)
add_to_alarm_whitelist — Add to alarm whitelist (加入告警白名单)
add_to_login_whitelist — Add to login whitelist (加入登录白名单)
unhandle — Restore to unhandled (恢复未处理)
do_not_ignore — Cancel ignore (取消忽略)
remove_from_alarm_whitelist — Remove from alarm whitelist (删除告警白名单)
remove_from_login_whitelist — Remove from login whitelist (删除登录白名单)

⚠️ ⛔ isolate_and_kill（隔离查杀）、do_not_isolate_or_kill 虽为 API 支持值，但本技能明确不执行隔离/杀毒等高危动作，AI 不得使用。

Update vulnerability handling status:

bash

hcloud HSS ChangeVulStatus --cli-region={region} --project_id={project_id} \
  --operate_type={ignore|not_ignore|immediate_repair|manual_repair|verify|add_to_whitelist} \
  --data_list.1.vul_id={vul_id} --host_data_list.1.host_id={host_id}

⚠️ 漏洞与主机通过 --data_list.[N].vul_id + --host_data_list.[N].host_id 关联传递（没有顶层 `--vul_id`/`--host_id` 参数）。

⚠️ Both ChangeEvent and ChangeVulStatus are mutating operations. Always prompt the user for confirmation before executing.

Parameter Confirmation

Parameter	Required	Description	Example
`--cli-region`	Yes	Target region	`{your-region}`
`--project_id`	Yes	Project ID (auto-detected if omitted)	Auto from CLI profile
`--host_id`	No	Filter by host ID	`xxxxxxxx-xxxx-xxxx`
`--severity`	No	Risk severity filter	`critical`, `high`, `medium`, `low`
`--type`	No	Vulnerability type	`linux_vul`, `windows_vul`, `web_cms`
`--repair_priority`	No	Vulnerability repair priority	`critical`, `high`, `medium`, `low`
`--handle_status`	No	Alert handling status filter	`handled`, `unhandled`
`--event_class_ids.N`	No	Event class ID filter (indexed)	`av_1004` (trojan)
`--limit`	No	Page size (default 10)	`10`
`--offset`	No	Page offset (default 0)	`0`
`--enterprise_project_id`	No	Enterprise project filter	`0` for default
`--asset_value`	No	Asset importance filter	`important`, `common`, `test`

Output Format

All commands return JSON by default. For inspection reports, the skill aggregates multiple query results into a structured risk summary:

json

{
  "inspection_time": "2026-08-28T10:00:00Z",
  "region": "{region}",
  "host_summary": { "total": 10, "protected": 8, "at_risk": 3 },
  "vulnerabilities": { "critical": 2, "high": 5, "medium": 12, "low": 8 },
  "baselines": { "pass_rate": "85%", "failed_rules": 7 },
  "alerts": { "unhandled_trojan": 1, "unhandled_brute_force": 3 },
  "risk_score": 72,
  "recommendations": ["Fix 2 critical vulnerabilities on host xxx", "Handle 1 unhandled trojan alert"]
}

Reference Documents

references/cli-installation-guide.md — hcloud CLI installation and authentication
references/iam-policies.md — Least-privilege IAM policies for HSS
references/verification-method.md — Verification and testing methods
references/dataflow-diagram.md — Data flow diagram
references/acceptance-criteria.md — Acceptance criteria
references/hss-event-class-reference.md — HSS event class ID reference

KooCLI Command Format Standard

bash

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} [--key=value ...]

Feature	Description	Example
Service name	`HSS` (exact KooCLI service name)	`HSS`
Operation name	PascalCase	`ListHostStatus`, `ShowVulStatics`, `ChangeEvent`
Region parameter	`--cli-region=<value>`	`--cli-region={region}`
Simple parameter	`--key=value`	`--host_id=xxx`
Indexed parameter	`--key.1=value1`	`--host_id_list.1=xxx`

タスクに関連する項目

同じリポジトリから

huawei-cloud-billing-scout

Huawei Cloud BSS billing (not AWS/Azure/other clouds; refuses pricing quotes, real-name review, and any non-billing scope): balance, spend, attribution, reconciliation, coupons, stored-value cards, enterprise/partner billing. One-page briefing via hcloud. Use only when the user explicitly mentions 华为云 / Huawei Cloud / BSS and 余额/账单/对账/资源包/代金券/储值卡/企业或伙伴账务; refuses pay, renew, refund, delete.

導入数: 3
GitHub Stars: 59
更新日: 10月26日

huawei-cloud-cci-instance-management

Huawei Cloud CCI (Cloud Container Instance) full lifecycle management using hcloud CLI. Covers Namespace, Network, Deployment, StatefulSet, Pod creation/update/delete/status, EIPPool for public IP, logs and metrics. Two-step confirmation for all destructive operations (delete namespace cascades all resources under it). Use this skill when the user wants to operate CCI serverless containers via command line. Triggers: CCI, 云容器实例, serverless container, 容器实例, namespace, deployment, statefulset, pod

導入数: 3
GitHub Stars: 59
更新日: 10月26日

huawei-cloud-computing-query

Queries Huawei Cloud computing resources (ECS/BMS/IMS/AS), Covers ECS instances, flavors, keypairs, quotas, server groups, block devices, NICs, VNC console, BMS bare metal servers/flavors/quotas, IMS images/OS versions/members/quotas, and AS scaling groups/configs/policies/activity logs/lifecycle hooks/warm pools/quotas. No write operations. Use this skill when the user needs to query ECS instance details, list flavors, check BMS availability, browse images, or view auto-scaling group/policy sta

導入数: 3
GitHub Stars: 59
更新日: 10月26日

huawei-cloud-find-skills

Invoke this skill to search, list, query, discover, browse, find and install any Huawei Cloud (华为云) agent skill. Triggers include: "华为云", "华为云有什么skill", "华为云相关skill", "华为云agent skill 市场", "华为云skill类目", "explore Huawei Cloud skills", "show Huawei Cloud skill categories", "does a Huawei Cloud skill exist for...", "which Huawei Cloud skills exist", "搜索华为云技能", "查询华为云skill列表", "有没有管理ECS/OBS/RDS的skill", "帮我找 XX 华为云skill", "介绍 XX Skill 内容", "华为云 XX Skill 具体做什么", "安装华为云Skill".

導入数: 3
GitHub Stars: 59
更新日: 10月26日

MIT9 ファイル

詳細を見る →

huawei-cloud-hss-query

使い方

開始前の確認

Huawei Cloud HSS Host Security Skill

Overview

Prerequisites

Workflow

Core Commands

1. Host Assets (主机资产)

2. Vulnerabilities (漏洞)

3. Security Baselines (安全基线)

4. Intrusion Alerts — Trojan & Malware (木马/恶意软件告警)

5. Intrusion Alerts — Brute Force (暴力破解告警)

6. Login Audit Logs (登录审计日志)

7. Risk Diagnosis (风险诊断)

8. Update Alert Handling Status (告警处置) — ⚠️ Mutating, Requires Confirmation

Parameter Confirmation

Output Format

Reference Documents

KooCLI Command Format Standard

タスクに関連する項目

code-review

diagnosing-bugs

springboot-verification

verification-loop

関連する Skills

huawei-cloud-billing-scout

huawei-cloud-cci-instance-management

huawei-cloud-computing-query

huawei-cloud-find-skills