huawei-cloud-business-tf-support

SUSPICIOUS: the Huawei Cloud auth model and official SDK usage are plausible, but the skill’s actual footprint is broader than its billing-only description and it requires executing opaque bundled installer/query scripts with cloud credentials. No direct evidence of malware or third-party credential exfiltration is shown, yet the hidden install path and purpose mismatch make the skill medium-high risk.

This module is a legitimate-looking environment bootstrap/verification utility for Huawei Cloud SDK usage, with no obvious backdoor/exfiltration behavior in the snippet. However, it contains significant supply-chain/transport-layer weaknesses: it disables HTTPS certificate validation globally and executes a remotely downloaded get-pip.py without integrity verification, then installs third-party dependencies via pip (optionally from dynamically selected mirrors with relaxed trust). These behaviors materially increase the risk of MITM or malicious dependency/script substitution during setup.