Huawei Cloud IAM Query Skill: Read-Only Identity Lookups

Lets an agent look up Huawei Cloud IAM users, groups, policies, agencies and MFA status through bundled read-only scripts.

Installs: 17.5K; on skills.sh
Stars: 59; on GitHub
Files: 60+; besides SKILL.md
Updated: Oct 2026; last repo commit

This is Huawei Cloud's own query skill for identity and access. The agent runs one of the bundled Python scripts per lookup: users, groups, policies, agencies, access keys, MFA devices, login, password and ACL policies, security compliance and account quotas. SKILL.md says it has no write operations.

Before the first query the agent runs an environment check script. It builds a .venv in the skill folder, installs the Huawei Cloud SDK with pip and tests your keys with an IAM call. You must set HW_ACCESS_KEY and HW_SECRET_KEY first. SKILL.md writes every script call as skill action=exec with skill:// paths, and the README does not say which agent supports that form.

Good for

Security teams reviewing who has which policies and agencies
Admins checking MFA, login and password policy settings
Anyone auditing access keys and their last use

Install huawei-cloud-iam-query

Claude Code

Copy this prompt.

Install the huawei-cloud-iam-query skill in Claude Code. Run this command:

npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-iam-query

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

There is no separate install step for the Python side. SKILL.md has the agent run scripts/check_env.sh (scripts/check_env.ps1 on Windows) first, which creates a .venv in the skill folder and pip-installs the Huawei Cloud SDK packages. Set the key variables in your shell before you start the agent. SKILL.md writes every script call as skill action=exec with skill:// paths, and the README does not say which agent supports that form. The repo has no plugin manifest, so there is no plugin route, and there is no Claude app tab because the skill runs local Python.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Queries Huawei Cloud identity and access management resources (IAM) via read-only Python SDK. Covers users, groups, policies, agencies, AK/SK, MFA devices, login/password/ACL policies, security compliance, and account quotas. No write operations. Use this skill when the user needs to query IAM identity info, check policies/permissions, view agency details, or inspect AK/SK/MFA status. Triggers: IAM, 用户, 用户组, 策略, 委托, 权限, AK/SK, MFA, 密码策略, 安全合规, 身份查询, 身份认证, identity, policy, agency.

Sections in SKILL.md

Overview
Capability Scope
Usage Principles
Prerequisites
Execution Flow
Step 1: Environment Preparation
Step 2: Identify and Execute Query Scripts
Directory Structure
Parameter Confirmation
Output Format
Verification Method
Best Practices
Reference Documentation
Notes

Key facts

Author: Huawei Cloud (the skill is in the vendor's own huaweicloud/huaweicloud-skills repo; the README calls these officially maintained Huawei Cloud Agent Skills)
License: MIT (LICENSE file and README badge; the LICENSE copyright line still reads "[year] [fullname]")
Installs on skills.sh: 17,532 (Nov 2, 2026)
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn (Nov 2, 2026)
GitHub stars: 59 for the whole huaweicloud/huaweicloud-skills repo (Nov 2, 2026)
Last repo commit: Oct 31, 2026
What it includes: 112 files including SKILL.md (counted from the repo tree): 107 Python files, 2 Markdown files, check_env.sh, check_env.ps1 and requirements.txt. The Python files are 105 query scripts in scripts/iam plus config.py and ensure_env.py.
Needs: Python 3.6 or newer, plus HW_ACCESS_KEY and HW_SECRET_KEY in the environment (SKILL.md)
Works in: The README names no client; it says the skills are "compatible with mainstream AI Agents"

What it includes

Builds the Python environment and tests your keys before any query
Runs scripts/check_env.sh (or check_env.ps1 on Windows). It checks Python, installs the SDK packages into a .venv, imports them and makes an IAM call to confirm the key works.
Try: “Check my Huawei Cloud setup, then list my IAM users.”
Runs code · Environment check
Scripts that list and show users, groups and their memberships
Lists IAM users and groups, shows one user or group, and lists which groups a user belongs to.
Try: “List the IAM users and the groups each one is in.”
Network · Users and groups
Scripts for policies, policy versions, agencies and permissions
Lists and shows system and custom policies, policy versions, agencies, and the permissions attached to users, groups and agencies.
Try: “Show the policies attached to my admin group.”
Network · Policies and agencies
Scripts for access key status, last use and MFA devices
The guide lists scripts that show access keys with their user, status and creation time, when a key was last used, and MFA devices.
Try: “Which access keys have not been used recently?”
Network · Access keys and MFA
Scripts for login, password and ACL policies and compliance
Shows the domain login, password, API ACL and console ACL policies, security compliance settings and quotas.
Try: “Show our password policy and login policy.”
Network · Account policies
Finds the project ID for a region
The get_project_id.py script asks IAM for the project that matches a region.
Network · Project ID lookup

From the official docs

Permissions

Medium risk

Your cloud key is used by scripts that run on your machine, TLS certificate checks are turned off, and the results can list your users and access keys. Use a key that can only read IAM, on a network you trust.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It turns off TLS certificate checks
scripts/config.py sets ignore_ssl_verification = True for the Huawei Cloud SDK, and scripts/ensure_env.py switches Python to an unverified HTTPS context. Use it only on a network you trust. github.com
Its setup script installs packages with pip
ensure_env.py creates a .venv in the skill folder and runs pip install -r requirements.txt, trying repo.huaweicloud.com, pypi.tuna.tsinghua.edu.cn and mirrors.aliyun.com with --trusted-host before plain PyPI. If pip is missing it can fetch get-pip.py from mirrors.huaweicloud.com or bootstrap.pypa.io. github.com
It uses your cloud keys and calls IAM to test them
The scripts read the HW_ACCESS_KEY and HW_SECRET_KEY environment variables. The environment check makes a live IAM call to confirm they work. Use a key that can only read. github.com
Identity details go into the chat
Results can include user names, group members, policies, agencies and access key status. Do not run it in a shared session you would not show a colleague. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	SKILL.md says this is a read-only query skill. There is no switch to enforce it.
Talks to	Huawei Cloud API endpoints through the Huawei Cloud Python SDK. repo.huaweicloud.com, pypi.tuna.tsinghua.edu.cn, mirrors.aliyun.com and PyPI during the pip install. mirrors.huaweicloud.com and bootstrap.pypa.io if pip must be bootstrapped
Sign-in and keys	The scripts read the key from environment variables. SKILL.md says not to print the values.
Scopes	Reads HW_ACCESS_KEY, HW_SECRET_KEY, HW_REGION_NAME, HW_PROJECT_ID and HW_SECURITY_TOKEN from your environment Calls Huawei Cloud APIs to look up IAM users, groups, policies, agencies, access keys and MFA state Writes a .venv folder inside the skill folder

Questions

What does huawei-cloud-iam-query do?

It makes an agent look up Huawei Cloud identity and access data by running bundled read-only Python scripts. It covers users, groups, policies, agencies, access keys, MFA and account-wide policies. SKILL.md says it only performs queries and does no write operations. Because it lists users, access keys and MFA state, give it a key that can only read IAM.

Does the IAM query skill need an API key?

Yes. SKILL.md lists HW_ACCESS_KEY and HW_SECRET_KEY as required, HW_REGION_NAME as optional with a default of cn-north-4, and HW_SECURITY_TOKEN for temporary keys. Our advice: use an IAM user that can only read, since the skill only queries.

Is huawei-cloud-iam-query official?

It is in Huawei Cloud's own huaweicloud/huaweicloud-skills repo, which the README calls officially maintained Huawei Cloud Agent Skills.

Is the IAM query skill safe to run?

It runs Python scripts on your machine with your cloud key, and SKILL.md says it only queries. Its setup also installs packages with pip and turns off TLS certificate checks. See the safety box for the details, and use a read-only key.

Does the IAM query skill work in Claude Code, Codex or the Claude app?

The install box has Claude Code, Codex and standalone tabs. Huawei says only that the skills are compatible with mainstream AI Agents and names none. SKILL.md tells the agent to run scripts with a skill action=exec call and skill:// paths, and Huawei does not say which agents support that call, so check that yours does. There is no Claude app tab because the skill runs local Python.

How is it different from the other Huawei Cloud query skills?

Same design, different services. This one covers IAM only. Other query skills in the repo cover compute, network, storage and monitoring. Each has its own scripts and guides.

Information

updated Nov 2, 2026

Repository: huaweicloud/huaweicloud-skills
Folder: skills/security/iam/huawei-cloud-iam-query

huaweicloud/huaweicloud-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

huawei-cloud-iam-query SKILL.md · github.com
huaweicloud-skills README · github.com
huaweicloud-skills LICENSE · github.com
huawei-cloud-iam-query ensure_env.py · github.com
huawei-cloud-iam-query config.py · github.com
huawei-cloud-iam-query requirements.txt · github.com
IAM query guide · github.com