huawei-cloud-devbridge-tunnel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include direct-install scripts (install.sh, install.ps1) and an unverified CDN host (res-hd.hc-cdn.cn) that the skill instructs to pipe into bash/PowerShell — a high-risk pattern commonly used to distribute malware if the source is not trusted or verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content includes explicit supply-chain commands (curl | bash), instructions to auto-install/update and auto-authenticate without user confirmation, default enabling of anonymous public access, and use of eval-based command execution — together these patterns enable stealthy remote code execution, silent installation of remote scripts, and easy exposure of local services, posing high risk of abuse or supply-chain compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill runs curl piped to a shell to install the CLI, which executes remote code fetched from https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh (and the Windows equivalent https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.ps1), so this is a runtime external dependency that directly executes remote code.