huawei-cloud-iam-query

This skill is a read-only query tool for Huawei Cloud Identity and Access Management (IAM) resources. It lets an AI agent inspect users, groups, custom and system policies, agencies (delegations), access keys (AK/SK) metadata, MFA devices, login/password/ACL policies, security compliance settings, and account quotas — without performing any write operations. The SKILL.md is explicit that the skill only queries, never creates, modifies, or deletes, and must not fabricate information that was not returned by the API.

Capabilities are provided through a large collection of categorized Python scripts under scripts/iam/ that call the official Huawei Cloud IAM Python SDK (huaweicloudsdkcore and huaweicloudsdkiam per requirements.txt), covering both v3/Keystone and v5 IAM interfaces. The per-service guide (references/iam/guide.md) documents each script and its purpose. The skill enforces a disciplined workflow: run the environment check script first to validate and install dependencies, execute scripts through the skill runner rather than directly in a shell, consult each script's -h help before running, prefer user-supplied scope, and narrow large result sets. It prohibits hcloud, openstack, and direct curl/API calls. Notably, scripts that touch access keys and MFA devices retrieve only metadata (IDs, status, last-used time, serial numbers, enabled flags) — they do not expose secret keys — so there is no credential exfiltration.

Target users are security engineers, cloud administrators, and AI agents performing identity audits, permission reviews, agency inspection, or AK/SK and MFA status checks on Huawei Cloud. As a read-only, SDK-based observability tool that surfaces only non-secret identity metadata, it is low risk.