huawei-cloud-devbridge-tunnel

SUSPICIOUS. The skill's tunnel-management purpose broadly matches its capabilities and its network destinations are Huawei Cloud endpoints, but the trust model is weak: it centers on an unverified remote installer that places a black-box CLI on the system and then feeds it authentication credentials. Combined with silent auto-install/login, background hosting, anonymous exposure defaults, and no-confirmation destructive actions, the overall footprint is high risk even without clear evidence of confirmed malware.

No direct malware behavior is demonstrated in this fragment because it is only an installation guide. However, it instructs users to execute remote installer scripts immediately (curl ... | bash and irm ... | iex) without any shown integrity/signature verification, and it installs/persists a binary in a user-writable PATH-enabled directory. This constitutes a meaningful supply-chain execution risk that should be mitigated by reviewing the installer scripts/binary and enforcing integrity checks (hash/signature/version pinning) before trust is granted.

No clear evidence of intentional malware (exfiltration, backdoor, persistence, or stealthy payload execution) is visible in this Bash fragment. The primary finding is a high-risk engineering pattern: `_db_exec_retry` uses `eval` on dynamically constructed command strings that are influenced by wrapper inputs and by parsed CLI text. In environments where arguments can be attacker-influenced, this can enable shell command injection. Treat as a security-relevant component and mitigate by removing `eval`, using safe exec/argv arrays, and enforcing strict quoting/escaping. Also, consumers should avoid blindly following the printed `curl ... | bash` guidance.