Huawei Cloud Network Topology Audit

Read-only orchestrator skill. This skill audits existing cloud resources — it never creates, modifies, or deletes any resource. All data collection is delegated to existing query skills (path A) or self-written scripts based on official documentation (path B).

Overview

This skill audits Huawei Cloud network topology for security and configuration risks. Given a user-described access path (e.g., "ELB web-elb → CCE prod-cce → RDS prod-db"), it:

1. Resolves the real topology from actual cloud resources
2. Expands to the full VPC network surface (VPCs, subnets, route tables, security groups, EIPs, ELBs, NAT gateways, ECS, RDS, CCE, DCS)
3. Evaluates risks against an extensible rule directory (rules/network-audit-rules.yaml)
4. Produces a Markdown audit report with a Mermaid topology diagram

Architecture

User describes access path (natural language)
         │
         ▼
 [Step 1]  Connectivity precheck  ── fail ──→  Prompt user to configure credentials
         │ pass
         ▼
 [Step 2]  Path parsing + find-skills lookup
         │
         ▼
 [Step 3]  Real topology discovery (Path A: query skills, Path B: self-written scripts)
         │
         ▼
 [Step 4]  Diff: described path vs real topology (real = source of truth)
         │
         ▼
 [Step 5]  User confirmation of the real topology
         │
         ▼
 [Step 6]  Risk audit against network-audit-rules.yaml
         │
         ▼
 [Step 7]  Markdown report generation (Mermaid diagram, ASCII fallback)

Applicable Scenarios

• User describes an access path with approximate resource names
• Current environment has configured Huawei Cloud credentials (CLI/SDK)
• Need structured audit of network topology risks

Not Applicable

• User cannot describe any resource names
• No Huawei Cloud credentials configured
• Need to modify resources (this skill is read-only)
• Cross-account audit (v1 limited to single account)

Prerequisites

1. Huawei Cloud credentials — Environment variables (HUAWEI_ACCESS_KEY / HUAWEI_SECRET_KEY or HW_AK / HW_SK / HWC_ACCESS_KEY / HWC_SECRET_KEY) or hcloud CLI config
2. Python 3.8+ — Required for scripts in scripts/
3. huaweicloudsdk packages — For path B resources (DCS): pip install huaweicloudsdkdcs
4. Network access — To GitCode for find-skills index queries
5. hcloud CLI (optional) — For CCE cluster queries via CCE management skill

Environment Variables

Workflow

Step 1: Connectivity Precheck

Run the precheck script to verify credentials are available and the API is reachable:

bash scripts/precheck.sh

• Exit 0: Credentials OK, VPC API reachable → proceed to Step 2
• Exit non-zero: Print error, tell user to configure credentials, stop

Step 2: Path Parsing & Find-Skills Lookup

Parse the user's natural-language access path:

1. Extract resource types and approximate names (e.g., "ELB web-elb" → type=elb_listener, name="web-elb")
2. For each resource type, look up the appropriate query skill in references/resource-skill-mapping.md
3. Call huawei-cloud-find-skills (via its search script) to confirm the query skill exists in the current index
4. Build a structured collection plan:
   • Path A resources → dispatch to query skill
   • Path B resources → use self-written script

Output: Structured path draft + collection path mapping

Step 3: Real Topology Discovery

Execute the collection plan:

Path A (existing query skills)

Path B (self-written scripts)

1. For each path A resource, invoke the query skill and collect structured data
2. For path B, run the self-written script
3. After collecting the described resources, expand to the full VPC network surface:
   • Find the VPC that contains the described resources
   • Query ALL resources in that VPC (all subnets, all security groups, all route tables, all EIPs, all ELBs, all NAT gateways, all ECS instances, all RDS instances, all CCE clusters, all DCS instances)
4. Merge all data into a unified topology dataset

Output: Real topology dataset (all resources in the VPC network surface)

Step 4: Diff Analysis

Compare the user-described path against the real topology:

1. For each resource in the user's description:
   • Match by approximate name (case-insensitive, substring match)
   • Confirm resource type
   • Record any differences (wrong name, wrong type, resource not found)
2. Build a diff list where the real topology is the source of truth
3. Flag resources the user mentioned that do not exist
4. Flag real resources that deviate from the described path

Output: Diff list — "described vs real" with real topology as authoritative

Step 5: User Confirmation

Present the user with:

1. Real access path (as resolved from cloud resources)
2. Diff list (where the description differed from reality)
3. Ask: "Is this the correct topology to audit? Reply 'yes' to proceed or describe corrections."

Wait for user confirmation. Do not proceed to Step 6 without it.

Step 6: Risk Audit

Load rules/network-audit-rules.yaml and evaluate each rule against the topology dataset:

1. For each rule, filter the topology for matching resource types
2. Apply the rule's condition to each matching resource
3. Rules with a trigger condition (e.g., "public port 22 open") flag matching resources
4. Collect all findings with: rule_id, resource_id, resource_name, severity, description, remediation
5. Sort findings by severity (critical → high → medium → low → info)
6. Deduplicate overlapping findings

Validate the rule directory before use:

python3 scripts/validate-rules.py rules/network-audit-rules.yaml

Output: Risk list (sorted by severity, each item traceable to a rule ID)

Step 7: Report Rendering

Generate a Markdown audit report containing:

1. Topology Summary — The real access path, VPC, and subnets
2. Security Group Inventory — Per-resource security group rules
3. Risk List — Sorted by severity, each with rule_id/resource/severity/description/remediation
4. Mermaid Topology Diagram — Visual representation of the network topology
5. Metadata — Audit timestamp, rule directory version, data sources used

Render the Mermaid diagram. If rendering fails, fall back to ASCII art:

bash scripts/mermaid-to-ascii.sh

Output: Final Markdown report (saved to a file and presented to the user)

Core Commands

Parameter Confirmation

Quality Reporting

This Skill integrates skill_quality_sdk.py for execution quality reporting. Every run automatically reports trace_id, status (success/biz_fail/sys_fail/cancel), error code, cost, and masked input/output to the operations console.

Integration

• Python entry point: wrap main logic with quality_context context manager:

  from skill_quality_sdk import quality_context, QualityError
  with quality_context(skill_name="huawei-cloud-network-topology-audit", skill_version="1.0.0") as q:
      q.input = {...}
      result = do_something()
      q.output = result
  

• CLI-only workflows: the SDK is vendored in scripts/ for future Python wrapper use

Error Code Convention

Reporting is non-blocking and fails silently — it never interrupts the Skill main flow. Disable via SKILL_QUALITY_DISABLE=1 for local testing.

Reference Documents

• Resource-Skill Mapping — Resource type → query skill mapping
• Official Doc Index — Official API/SDK docs for path B resources
• Severity Definitions — Five-level severity definitions
• Rule Authoring Guide — How to write/update audit rules
• IAM Policies — Required IAM permissions
• CLI Installation Guide — hcloud CLI installation
• Data Flow Diagram — Mermaid data flow diagram
• Verification Method — How to verify the skill
• Acceptance Criteria — Acceptance criteria