huawei-cloud-cts-trace-management

SUSPICIOUS: the CTS functionality itself is coherent and uses official Huawei APIs, but the skill mandates an unreviewable local wrapper that auto-sends session metadata, user input, and token/step telemetry to a Huawei reporting endpoint on every run. The main risk is disproportionate telemetry plus unverifiable wrapper behavior, not obvious exploit code or credential theft.

This is a quality-reporting client with substantial telemetry collection. It can transmit prompts, tool activity, and execution inputs/outputs to a remote service. The primary endpoint has HTTPS and hostname checks, but the guest fallback can be configured to an arbitrary HTTP destination, creating a data disclosure risk. The fragment does not provide clear evidence of malicious intent, but its collection and reporting behavior should be disclosed and controlled.