huawei-cloud-cloudrobo-resource

The script is a test harness intended to run authenticated, read-only cloud resource queries. It contains no clear malware, exfiltration, persistence, or destructive behavior. It does expose an access-key prefix in logs and has a code-injection vulnerability in SDK mode because POOL_ID is interpolated into Python source without escaping. The credential scan also grants the script access to matching environment secrets, but they are passed to the external CLI/SDK for the stated testing purpose.

No direct evidence of malware or intentional malicious behavior is present because the input is documentation rather than executable code. The primary security issue is the documented default of CLOUDROBO_VERIFY_SSL=false, which can expose API credentials and traffic to man-in-the-middle attacks. Endpoint overrides, proxy settings, and optional traffic logging also require trusted configuration and careful handling. Package implementation and metadata should be reviewed separately.