huawei-cloud-codearts-code-gen

SUSPICIOUS: the core purpose matches a cloud code-generation skill, and the target service is consistent with Huawei CodeArts, but the skill is overbearing and expands trust by forcing all coding through undocumented wrapper scripts, persisting plaintext AK/SK in shell config, and granting an external CLI workspace write access. This is not confirmed malware, but it carries meaningful credential, supply-chain, and remote-action risk.

No direct malicious behavior (e.g., exfiltration, reverse shells) is visible in this fragment. However, the script performs a critical supply-chain operation: it downloads a PowerShell install script from a remote URL and executes it via Invoke-Expression without any integrity verification (hash/signature/pinning). This pattern is frequently associated with supply-chain compromise pathways and should be treated as high risk. Additionally, AK/SK can be persisted into user environment variables when using --save-aksk, increasing credential exposure risk.

This script is primarily an environment bootstrapper, but it contains two major high-impact supply-chain/code-execution risks: (1) it downloads and executes a remote installer script without any integrity/provenance verification, and (2) it uses eval to execute text extracted from user-controlled shell configuration ($HOME/.bashrc), which can become arbitrary command execution if that file (or extracted lines) is tampered with. Additionally, it persistently stores the secret access key (SK) in plaintext in ~/.bashrc. There is no explicit malware/exfiltration behavior visible in this snippet, but the execution primitives present make it a notably risky package for supply-chain environments and should be reviewed/mitigated (remove eval, avoid plaintext SK storage, and verify installer integrity).