huawei-ecs-http-proxy-ssh

name	huawei-ecs-http-proxy-ssh
description	Use this skill when the user needs Codex to SSH into a remote Huawei Cloud ECS, or any Linux host, from a corporate network where direct SSH is blocked and access must go through an HTTP/HTTPS proxy using CONNECT. It covers checking proxy variables, proving TCP reachability, handling encrypted private keys without persisting passphrases, and executing remote commands reliably.

Huawei ECS SSH Through HTTP Proxy

Use this skill when SSH to an ECS works only through a corporate HTTP proxy. Prefer this flow when direct ssh or Test-NetConnection times out but the user says HTTP proxy access is required.

Required Inputs

• Host and SSH port, e.g. <ecs_public_ip>:4444.
• SSH user, usually root or ubuntu.
• Private key path.
• Known-hosts file path if the ECS host key is not already in the user's standard SSH known-hosts store.
• Proxy source:
  • Existing HTTP_PROXY / HTTPS_PROXY environment variables, or
  • explicit proxy URL.
• If the private key is encrypted, get the passphrase from the user only for the current task. Do not write it to files.

Rules

• Never persist SSH passphrases, proxy passwords, ECS credentials, API keys, or bearer tokens in skill files or generated artifacts.
• Prefer /32 security group rules for the current client egress IP. Do not suggest 0.0.0.0/0 unless the user explicitly accepts that risk.
• When using a passphrase, pass it through an environment variable for a single command and remove that variable immediately afterward.
• Verify SSH host keys by default. Only use --insecure-accept-host-key for short-lived diagnostics when the user explicitly accepts the MITM risk.