Ucloud Api Skill

Invoke UCloud APIs through the official Python SDK. Use when an AI agent needs to inspect, create, update, or delete UCloud resources by calling real UCloud...

This skill will execute bundled Python scripts that call the UCloud SDK and require your UCloud public/private keys (and optionally project/region/zone). Before enabling or providing credentials: - Verify the skill's source and author; the registry metadata currently omits the credential requirements but the SKILL.md and scripts do require keys. - Only provide least-privilege keys (scoped to a test project) and avoid using high-privilege or billing-enabling credentials in production until you've tested behavior. - Expect the agent to be able to make real, billable changes (create/delete EIPs, VMs). Configure the agent to ask for explicit confirmation before any destructive or billable action. - Review UCLOUD_BASE_URL usage: if you or the environment set this variable it can point the SDK to a custom endpoint; ensure it is trusted. - If you need higher assurance, run the scripts in an isolated environment (test project) first and inspect network traffic or run under your own control before granting persistent access. The main issue here is inconsistent metadata (the skill fails to declare required credentials). That mismatch is likely sloppy configuration—not proof of malicious intent—but you should correct/confirm the metadata and follow the precautions above before use.

Type: OpenClaw Skill Name: ucloud Version: 0.1.1 The ucloud-api skill bundle is a legitimate toolset for interacting with UCloud services via the official Python SDK. It includes scripts for invoking OpenAPI actions (invoke_ucloud.py), resolving account parameters like regions and projects (resolve_common_params.py), and generating secure alphanumeric passwords (generate_password.py). The instructions in SKILL.md emphasize transparency, requiring the agent to inform users about default actions (like EIP creation) and to confirm details before executing destructive operations. No evidence of data exfiltration, malicious obfuscation, or unauthorized persistence was found.