huawei-cloud-business-tf-support

Warn

Audited by Socket on Oct 9, 2026

2 alerts found:

Anomalyx2
AnomalyLOW
SKILL.md

SUSPICIOUS. The declared purpose is Terraform billing/pricing support, but the body expands into broad Huawei resource-query behavior, creating a clear purpose-capability mismatch. There is no evidence of overt malware or third-party credential routing, and the likely API targets are official Huawei services, but the unseen environment-check/install scripts and credential-consuming local code prevent a benign classification.

Confidence: 84%Severity: 57%
AnomalyLOW
scripts/ensure_env.py

The code appears to be an environment setup and Huawei Cloud credential-checking utility, not clear malware. However, globally disabling TLS verification and attempting to execute a remotely downloaded installer create a significant supply-chain and interception risk. Dependency installation and privileged system package installation also have security impact.

Confidence: 96%Severity: 67%
Audit Metadata
Analyzed At
Oct 9, 2026, 03:53 PM
Package URL
pkg:socket/skills-sh/huaweicloud%2Fhuaweicloud-skills%2Fhuawei-cloud-business-tf-support%2F@156d498f5147c88ef148113ac36cd58d6fa36ef66e505c4467a00fda97d20296