Huawei Cloud Network Query Skill: Read-Only VPC Lookups

Lets an agent look up Huawei Cloud VPCs, security groups, load balancers, NAT, VPN and DNS through bundled read-only scripts.

Installs: 17.5K; on skills.sh
Stars: 59; on GitHub
Files: 60+; besides SKILL.md
Updated: Oct 2026; last repo commit

This is Huawei Cloud's own query skill for networking. For each lookup the agent runs one of the bundled Python scripts. They cover VPCs, subnets, security groups, firewalls, route tables, flow logs, EIPs, bandwidths, load balancers, NAT gateways, VPN gateways and connections, and DNS zones and records. SKILL.md says it has no write operations.

Before the first query the agent runs an environment check script. It builds a .venv in the skill folder, installs the Huawei Cloud SDK with pip and tests your keys with an IAM call. You must set HW_ACCESS_KEY and HW_SECRET_KEY first. SKILL.md writes every script call as skill action=exec with skill:// paths, and the README does not say which agent supports that form.

Good for

Cloud engineers checking security group rules, routes and subnets
Teams reviewing load balancer, NAT and VPN setup before a change
Anyone who needs real VPC and subnet IDs for automation

Install huawei-cloud-network-query

Claude Code

Copy this prompt.

Install the huawei-cloud-network-query skill in Claude Code. Run this command:

npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-network-query

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

There is no separate install step for the Python side. SKILL.md has the agent run scripts/check_env.sh (scripts/check_env.ps1 on Windows) first, which creates a .venv in the skill folder and pip-installs the Huawei Cloud SDK packages. Set the key variables in your shell before you start the agent. SKILL.md writes every script call as skill action=exec with skill:// paths, and the README does not say which agent supports that form. The repo has no plugin manifest, so there is no plugin route, and there is no Claude app tab because the skill runs local Python.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Queries Huawei Cloud network resources (VPC/EIP/ELB/NAT/VPN/DNS). Covers VPCs, subnets, security groups, firewalls, route tables, flow logs, EIPs, bandwidths, load balancers, listeners, pools, health monitors, NAT gateways, SNAT/DNAT rules, VPN gateways, VPN connections, DNS zones, record sets, PTR records, and endpoints. No write operations. Use this skill when the user needs to query network topology, security group rules, load balancer config, NAT rules, VPN status, or DNS resolution info. Triggers: VPC, 子网, 安全组, EIP, 弹性公网IP, ELB, 负载均衡, NAT网关, VPN, DNS, 域名解析, 路由表, 防火墙, 带宽, network, subnet, security group.

Sections in SKILL.md

Overview
Capability Scope
Usage Principles
Prerequisites
Execution Flow
Step 1: Environment Preparation
Step 2: Identify and Execute Query Scripts
Directory Structure
Parameter Confirmation
Output Format
Verification Method
Best Practices
Reference Documentation
Notes

Key facts

Author: Huawei Cloud (the skill is in the vendor's own huaweicloud/huaweicloud-skills repo; the README calls these officially maintained Huawei Cloud Agent Skills)
License: MIT (LICENSE file and README badge; the LICENSE copyright line still reads "[year] [fullname]")
Installs on skills.sh: 17,536 (Nov 2, 2026)
skills.sh audits: Gen Agent Trust Hub warn, Socket pass, Snyk pass (Nov 2, 2026)
GitHub stars: 59 for the whole huaweicloud/huaweicloud-skills repo (Nov 2, 2026)
Last repo commit: Oct 31, 2026
What it includes: 228 files including SKILL.md (counted from the repo tree): 218 Python files, 7 Markdown files, check_env.sh, check_env.ps1 and requirements.txt. The Python files are 216 query scripts in 7 folders (elb 51, dns 46, vpc 40, vpn 34, nat 30, eip 14, iam 1) plus config.py and ensure_env.py.
Needs: Python 3.6 or newer, plus HW_ACCESS_KEY and HW_SECRET_KEY in the environment (SKILL.md)
Works in: The README names no client; it says the skills are "compatible with mainstream AI Agents"

What it includes

Builds the Python environment and tests your keys before any query
Runs scripts/check_env.sh (or check_env.ps1 on Windows). It checks Python, installs the SDK packages into a .venv, imports them and makes an IAM call to confirm the key works.
Try: “Check my Huawei Cloud setup, then list my VPCs in cn-north-4.”
Runs code · Environment check
40 scripts for VPCs, subnets, security groups, routes and flow logs
Looks up VPCs, subnets, security groups and their rules, firewalls, route tables and flow logs.
Try: “Show the inbound rules of my security groups in cn-north-4.”
Network · VPC queries
14 scripts for public IPs and bandwidths
Lists elastic IPs and bandwidths.
Try: “List my elastic IPs and their bandwidths.”
Network · EIP queries
51 scripts for load balancers, listeners, pools and health monitors
Reads load balancers, listeners, backend pools and health monitors.
Try: “Show the listeners on my load balancers.”
Network · ELB queries
30 scripts for NAT gateways and SNAT/DNAT rules
Reads NAT gateways and their SNAT and DNAT rules.
Try: “List the DNAT rules on my NAT gateways.”
Network · NAT queries
34 scripts for VPN gateways and connections
Reads VPN gateways and VPN connections and their status.
Try: “Show the status of my VPN connections.”
Network · VPN queries
46 scripts for zones, record sets, PTR records and endpoints
Reads DNS zones, record sets, PTR records and endpoints.
Try: “List the record sets in my DNS zones.”
Network · DNS queries

From the official docs

Permissions

Medium risk

Your cloud key is used by scripts that run on your machine and talk to Huawei Cloud, and TLS certificate checks are turned off. Use a key that can only read, on a network you trust.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It turns off TLS certificate checks
scripts/config.py sets ignore_ssl_verification = True for the Huawei Cloud SDK, and scripts/ensure_env.py switches Python to an unverified HTTPS context. Use it only on a network you trust. github.com
Its setup script installs packages with pip
ensure_env.py creates a .venv in the skill folder and runs pip install -r requirements.txt, trying repo.huaweicloud.com, pypi.tuna.tsinghua.edu.cn and mirrors.aliyun.com with --trusted-host before plain PyPI. If pip is missing it can fetch get-pip.py from mirrors.huaweicloud.com or bootstrap.pypa.io. github.com
It uses your cloud keys and calls IAM to test them
The scripts read the HW_ACCESS_KEY and HW_SECRET_KEY environment variables. The environment check makes a live IAM call to confirm they work. Use a key that can only read. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	SKILL.md says this is a read-only query skill. There is no switch to enforce it.
Talks to	Huawei Cloud API endpoints through the Huawei Cloud Python SDK. repo.huaweicloud.com, pypi.tuna.tsinghua.edu.cn, mirrors.aliyun.com and PyPI during the pip install. mirrors.huaweicloud.com and bootstrap.pypa.io if pip must be bootstrapped
Sign-in and keys	The scripts read the key from environment variables. SKILL.md says not to print the values.
Scopes	Reads HW_ACCESS_KEY, HW_SECRET_KEY, HW_REGION_NAME, HW_PROJECT_ID and HW_SECURITY_TOKEN from your environment Calls Huawei Cloud APIs to look up VPCs, security groups, load balancers, NAT, VPN and DNS Writes a .venv folder inside the skill folder

Questions

What does huawei-cloud-network-query do?

It makes an agent look up Huawei Cloud network resources by running bundled read-only Python scripts. It covers VPC, EIP, ELB, NAT, VPN and DNS. SKILL.md says it only performs queries and does no write operations. It lists creating, modifying and deleting resources as things it does not handle.

Does the network query skill need an API key?

Yes. SKILL.md lists HW_ACCESS_KEY and HW_SECRET_KEY as required, HW_REGION_NAME as optional with a default of cn-north-4, and HW_SECURITY_TOKEN for temporary keys. Our advice: use an IAM user that can only read, since the skill only queries.

Is huawei-cloud-network-query official?

It is in Huawei Cloud's own huaweicloud/huaweicloud-skills repo, which the README calls officially maintained Huawei Cloud Agent Skills.

Is the network query skill safe to run?

It runs Python scripts on your machine with your cloud key, and SKILL.md says it only queries. Its setup also installs packages with pip and turns off TLS certificate checks. See the safety box for the details, and use a read-only key.

Does the network query skill work in Claude Code, Codex or the Claude app?

The install box has Claude Code, Codex and standalone tabs. Huawei says only that the skills are compatible with mainstream AI Agents and names none. SKILL.md tells the agent to run scripts with a skill action=exec call and skill:// paths, and Huawei does not say which agents support that call, so check that yours does. There is no Claude app tab because the skill runs local Python.

How is it different from the Huawei Cloud computing or storage query skills?

Same design, different services. This one covers VPC, EIP, ELB, NAT, VPN and DNS. The computing query skill covers ECS, BMS, IMS and AS, and the storage query skill covers EVS, OBS, SFS and CBR. Each has its own scripts and guides.

Information

updated Nov 2, 2026

Repository: huaweicloud/huaweicloud-skills
Folder: skills/network/ops/huawei-cloud-network-query

huaweicloud/huaweicloud-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6

huawei-cloud-network-query SKILL.md · github.com
huaweicloud-skills README · github.com
huaweicloud-skills LICENSE · github.com
huawei-cloud-network-query ensure_env.py · github.com
huawei-cloud-network-query config.py · github.com
huawei-cloud-network-query requirements.txt · github.com