华为云网络拓扑审计

安装指南

1. ClawHub CLI 从源直接安装技能的最快方式。
   npx clawhub@latest install huawei-cloud-network-topology-audit
2. 手动安装 将技能文件夹复制到以下位置之一
   全局模式
   ~/.openclaw/skills/
   工作区
   /skills/
   优先级：工作区 > 本地 > 内置
3. 提示词安装 将此提示词复制到 OpenClaw 即可自动安装。
   请帮我使用 Clawhub 安装 huawei-cloud-network-topology-audit。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。
   更倾向于下载？
   获取包含原生技能文件的ZIP压缩包。
   下载技能 (.zip)

什么是

华为云网络拓扑审计是一个只读编排工具，用于评估云网络配置与安全性。提供 ELB → CCE → RDS 等访问路径后，它会发现相应资源，将审查范围扩展到整个 VPC 网络，并将实际拓扑与您的描述进行比较。
该技能会依据可扩展的 YAML 规则目录检查已发现的资源，然后生成 Markdown 报告，其中包含按严重性排序的发现、修复指南和 Mermaid 拓扑图。对于使用 Openclaw Skills 的团队，它提供了一种结构化的方式来调查华为云网络风险，同时确保云资源不受影响。

应用场景

审计描述的应用路径，例如连接到 CCE 集群和 RDS 实例的 ELB。
检查 VPC 更广泛的网络范围，包括子网、路由表、安全组、EIP、NAT 网关、ECS、RDS、CCE 和 DCS 资源。
使用可版本管理、可扩展的一组审计规则，识别安全和配置风险。
在开始审计前，将假定的网络路径与实时云资源进行比较。
生成可分享的 Markdown 报告，其中包含发现、修复建议和拓扑图。

工作原理

检查连接：运行预检查，验证华为云凭据和 VPC API 访问权限。如果检查失败，则停止并请求配置。
解析访问路径：从用户描述中提取资源类型和近似名称，然后将资源类型映射到可用的查询技能或脚本。
发现资源：通过现有技能或 DCS 脚本查询华为云，然后将收集范围扩展到相关 VPC 中所有受支持的资源。
与描述进行比较：按类型和近似名称匹配资源，记录差异，并将发现的云拓扑视为权威信息。
确认拓扑：向用户展示已解析的路径和差异；等待用户确认后再进行审计。
评估风险：验证并加载 rules/network-audit-rules.yaml，将其中的条件应用于匹配的资源，并对发现结果去重，再按严重到提示级排序。
生成报告：生成 Markdown 报告，其中包含拓扑详情、安全组清单、发现、元数据和 Mermaid 图表。如果图表渲染失败，则使用 ASCII 备用图。

配置指南

前提条件
通过受支持的环境变量或 hcloud CLI 配置提供华为云凭据。
脚本 scripts/ 需要 Python 3.8 或更高版本。
需要网络访问 GitCode，以查询 find-skills 索引。
查询 DCS 时，请安装华为云 DCS SDK 软件包。
hcloud CLI 为可选项，可通过 CCE 管理技能用于查询 CCE 集群。
配置凭据
设置一组受支持的凭据，例如 HUAWEI_ACCESS_KEY 和 HUAWEI_SECRET_KEY，或配置 hcloud CLI 凭据。该技能还识别 HW_AK/HW_SK 和 HWC_ACCESS_KEY/HWC_SECRET_KEY。
验证访问权限并准备审计
bash scripts/precheck.sh
pip install huaweicloudsdkdcs
python3 scripts/validate-rules.py rules/network-audit-rules.yaml
使用 Path B DCS 查询脚本时，需要安装 DCS SDK。要运行审计，请提供自然语言描述的访问路径和华为云区域，例如 cn-north-4。输出路径（例如 ./audit-report.md）为可选项。此只读技能不会安装或修改任何资源。
可选的质量报告
质量报告为非阻塞功能，可使用 SKILL_QUALITY_DISABLE=1 禁用，以便进行本地测试。可选设置包括 SKILL_QUALITY_ENDPOINT、SKILL_QUALITY_NAME 和 SKILL_QUALITY_TIMEOUT。

数据架构

拓扑数据集
收集的数据会合并到统一的拓扑数据集中，覆盖相关 VPC 网络范围。受支持的资源类型包括：
VPC、子网、路由表和安全组
EIP、ELB 和 NAT 网关
ECS 实例、RDS 实例、CCE 集群和 DCS 实例
审计规则
文件 用途
rules/network-audit-rules.yaml 可扩展规则，用于定义资源筛选条件、触发条件、严重性、描述和修复指南
references/severity-definitions.md 严重、高、中、低和提示级别的定义
references/rule-authoring-guide.md 编写和更新规则的指南
报告内容
生成的 Markdown 报告包括已解析的访问路径、VPC 和子网摘要、各资源的安全组规则、按严重性排序的发现、修复指南、Mermaid 拓扑图，以及时间戳、规则目录版本和数据来源等审计元数据。报告会保存到文件并呈现给用户；指定 --output 可选择报告路径。如果 Mermaid 渲染失败，工作流支持使用 ASCII 图作为备用方案。
相关参考资料
references/ 目录记录了资源到查询技能的映射、官方 API 和 SDK 来源、IAM 策略、CLI 安装、数据流、验证方法和验收标准。

高级特性

只读操作：
该技能查询并审计现有资源；不会创建、修改或删除云资源。
混合式数据收集：
在可用时使用现有华为云查询技能，并使用自行编写的 SDK 脚本查询 DCS。
扩展到整个 VPC：
超出用户描述的路径，检查相关 VPC 中受支持的资源。
拓扑确认关卡：
在评估风险前，要求用户确认发现的拓扑。
可扩展规则：
将审计逻辑保存在经过验证的 YAML 规则目录中，且发现结果可追溯到规则 ID。
严重性排序与去重：
按严重到提示级排序发现结果，并删除重复内容。
图表备用方案：
生成 Mermaid 拓扑图，并提供 ASCII 备用图命令。
质量遥测：
支持非阻塞执行报告，包含跟踪 ID、状态、错误代码、成本以及经过掩码处理的输入/输出；可在本地测试时禁用报告。
范围限制：
需要资源名称和已配置的华为云凭据；版本 1 支持单个账户，不执行跨账户审计。

name: huawei-cloud-network-topology-audit description: >- Orchestrator skill that audits Huawei Cloud network topology for security and configuration risks.
Given a user-described access path (e.g., "ELB web-elb → CCE prod-cce → RDS prod-db"), it resolves
the real topology, expands to the full VPC network surface, evaluates risks against an extensible
rule directory, and produces a Markdown audit report with a Mermaid topology diagram.
Triggers include: "组网审计", "网络拓扑审计", "安全组审计", "网络合理性检查", "网络风险审计",
"network audit", "topology audit", "security group audit", "network risk check", "组网评估".
tags: [huawei-cloud, network, audit, topology, security]

Huawei Cloud Network Topology Audit

Read-only orchestrator skill. This skill audits existing cloud resources — it never creates, modifies, or deletes any resource. All data collection is delegated to existing query skills (path A) or self-written scripts based on official documentation (path B).

Overview

This skill audits Huawei Cloud network topology for security and configuration risks. Given a user-described access path (e.g., "ELB web-elb → CCE prod-cce → RDS prod-db"), it:

Resolves the real topology from actual cloud resources

Expands to the full VPC network surface (VPCs, subnets, route tables, security groups, EIPs, ELBs, NAT gateways, ECS, RDS, CCE, DCS)
Evaluates risks against an extensible rule directory (rules/network-audit-rules.yaml)
Produces a Markdown audit report with a Mermaid topology diagram

Architecture

User describes access path (natural language)
│
▼
[Step 1] Connectivity precheck ── fail ──→ Prompt user to configure credentials
│ pass
▼
[Step 2] Path parsing + find-skills lookup
│
▼
[Step 3] Real topology discovery (Path A: query skills, Path B: self-written scripts)
│
▼
[Step 4] Diff: described path vs real topology (real = source of truth)
│
▼
[Step 5] User confirmation of the real topology
│
▼
[Step 6] Risk audit against network-audit-rules.yaml
│
▼
[Step 7] Markdown report generation (Mermaid diagram, ASCII fallback)

Applicable Scenarios

User describes an access path with approximate resource names
Current environment has configured Huawei Cloud credentials (CLI/SDK)

Need structured audit of network topology risks

Not Applicable

User cannot describe any resource names

No Huawei Cloud credentials configured

Need to modify resources (this skill is read-only)
Cross-account audit (v1 limited to single account)

Prerequisites

Huawei Cloud credentials — Environment variables (HUAWEI_ACCESS_KEY / HUAWEI_SECRET_KEY or HW_AK / HW_SK / HWC_ACCESS_KEY / HWC_SECRET_KEY) or hcloud CLI config

Python 3.8+ — Required for scripts in scripts/

huaweicloudsdk packages — For path B resources (DCS): pip install huaweicloudsdkdcs
Network access — To GitCode for find-skills index queries
hcloud CLI (optional) — For CCE cluster queries via CCE management skill

Environment Variables

Variable Required Description

SKILL_QUALITY_ENDPOINT No Report endpoint, default https://skillsapi.developer.myhuaweicloud.com/api/quality/report
SKILL_QUALITY_NAME No Skill name (auto-detected)
SKILL_QUALITY_DISABLE No Set 1 to disable reporting (local dev)
SKILL_QUALITY_TIMEOUT No Report timeout in seconds (default 3)

Workflow

Step 1: Connectivity Precheck

Run the precheck script to verify credentials are available and the API is reachable:

bash scripts/precheck.sh

Exit 0: Credentials OK, VPC API reachable → proceed to Step 2
Exit non-zero: Print error, tell user to configure credentials, stop
Step 2: Path Parsing & Find-Skills Lookup

Parse the user's natural-language access path:

Extract resource types and approximate names (e.g., "ELB web-elb" → type=elb_listener, name="web-elb")
For each resource type, look up the appropriate query skill in references/resource-skill-mapping.md
Call huawei-cloud-find-skills (via its search script) to confirm the query skill exists in the current index
Build a structured collection plan:
Path A resources → dispatch to query skill
Path B resources → use self-written script

Output: Structured path draft + collection path mapping

Step 3: Real Topology Discovery

Execute the collection plan:

Path A (existing query skills)

Resource Query Skill Key Queries

VPC huawei-cloud-network-query ListVpcs, ShowVpc

Subnet huawei-cloud-network-query ListSubnets

Security Group huawei-cloud-network-query ListSecurityGroups, ShowSecurityGroup

Route Table huawei-cloud-network-query ListRouteTables

EIP huawei-cloud-network-query ListPublicips

ELB huawei-cloud-network-query ListLoadBalancers, ListListeners, ListPools
NAT huawei-cloud-network-query ListNatGateways, ListSnatRules, ListDnatRules

ECS huawei-cloud-computing-query ListServersDetails

RDS huawei-cloud-rds-smart-service ListInstances

CCE huawei-cloud-cce-cluster-management ListClusters, ListNodes
Path B (self-written scripts)

Resource Script SDK Used

DCS scripts/query-dcs-instances.py huaweicloudsdkdcs.v2
For each path A resource, invoke the query skill and collect structured data
For path B, run the self-written script
After collecting the described resources, expand to the full VPC network surface:

Find the VPC that contains the described resources

Query ALL resources in that VPC (all subnets, all security groups, all route tables, all EIPs, all ELBs, all NAT gateways, all ECS instances, all RDS instances, all CCE clusters, all DCS instances)

Merge all data into a unified topology dataset

Output: Real topology dataset (all resources in the VPC network surface)

Step 4: Diff Analysis

Compare the user-described path against the real topology:

For each resource in the user's description:
Match by approximate name (case-insensitive, substring match)

Confirm resource type

Record any differences (wrong name, wrong type, resource not found)
Build a diff list where the real topology is the source of truth

Flag resources the user mentioned that do not exist

Flag real resources that deviate from the described path

Output: Diff list — "described vs real" with real topology as authoritative

Step 5: User Confirmation

Present the user with:

Real access path (as resolved from cloud resources)
Diff list (where the description differed from reality)
Ask: "Is this the correct topology to audit? Reply 'yes' to proceed or describe corrections."

Wait for user confirmation. Do not proceed to Step 6 without it.

Step 6: Risk Audit

Load rules/network-audit-rules.yaml and evaluate each rule against the topology dataset:

For each rule, filter the topology for matching resource types
Apply the rule's condition to each matching resource
Rules with a trigger condition (e.g., "public port 22 open") flag matching resources
Collect all findings with: rule_id, resource_id, resource_name, severity, description, remediation
Sort findings by severity (critical → high → medium → low → info)

Deduplicate overlapping findings

Validate the rule directory before use:

python3 scripts/validate-rules.py rules/network-audit-rules.yaml

Output: Risk list (sorted by severity, each item traceable to a rule ID)

Step 7: Report Rendering

Generate a Markdown audit report containing:

Topology Summary — The real access path, VPC, and subnets
Security Group Inventory — Per-resource security group rules
Risk List — Sorted by severity, each with rule_id/resource/severity/description/remediation
Mermaid Topology Diagram — Visual representation of the network topology