huawei-cloud-devkit-webui-create

SUSPICIOUS. The skill is broadly aligned with its claimed purpose and mostly uses official Huawei channels, so it is not malicious on its face. But it has a large real-world footprint: cloud credential use, resource provisioning, SSH/SFTP access, remote script execution, mutable installer URLs, and optional automatic security-group changes. This makes it a medium/high operational-risk infrastructure skill rather than a benign low-risk guide.

The wrapper is consistent with a legitimate DevKit installation script, and no direct malware behavior such as data theft or reverse-shell logic is visible. However, it has a serious supply-chain trust weakness: signature verification authenticates only the archive/signature relationship because certificate validation is explicitly disabled, while both are fetched from a user-controlled URL. A malicious package with a self-generated signature can therefore pass this check. Unsafe tar extraction and the predictable /tmp fallback script add local privilege-impact risks. Use only with a fixed trusted URL and independently pinned publisher certificate or signature key, and harden archive and temporary-file handling.

The fragment is consistent with a cloud provisioning and remote DevKit installation utility, with no direct evidence of malware or intentional data theft. It has material security risks: unverified SSH host keys, root access over a public IP, shell command injection through insufficiently escaped installer arguments, and unsafe fallback to the first existing KMS key. The separately uploaded installation scripts require independent review before trusting the package.

The fragment describes a legitimate-looking Huawei cloud and Kunpeng DevKit deployment workflow and contains no direct evidence of malware. It does, however, execute remote scripts and a downloaded privileged installer, automatically changes the host and firewall, and does not show a pinned hash for the hcloud installer. The `-noverify` certificate option and password-in-log guidance are additional security weaknesses. Review the omitted helper and installer contents, pin and verify artifact hashes or trusted signer certificates, and restrict cloud permissions and network exposure before use.