huawei-cloud-devbridge-tunnel

SUSPICIOUS: the stated tunneling purpose is plausible, but the skill’s footprint is too trust-heavy for the safeguards provided. It silently installs and auto-updates an unverifiable external CLI, then forwards Huawei credentials to it and exposes local services remotely by default, including anonymous access and no-confirmation destructive actions.

No clear evidence of intentional malware (exfiltration, backdoor, persistence, or stealthy payload execution) is visible in this Bash fragment. The primary finding is a high-risk engineering pattern: `_db_exec_retry` uses `eval` on dynamically constructed command strings that are influenced by wrapper inputs and by parsed CLI text. In environments where arguments can be attacker-influenced, this can enable shell command injection. Treat as a security-relevant component and mitigate by removing `eval`, using safe exec/argv arrays, and enforcing strict quoting/escaping. Also, consumers should avoid blindly following the printed `curl ... | bash` guidance.

No direct malware behavior is demonstrated in this fragment because it is only an installation guide. However, it instructs users to execute remote installer scripts immediately (curl ... | bash and irm ... | iex) without any shown integrity/signature verification, and it installs/persists a binary in a user-writable PATH-enabled directory. This constitutes a meaningful supply-chain execution risk that should be mitigated by reviewing the installer scripts/binary and enforcing integrity checks (hash/signature/version pinning) before trust is granted.