huawei-cloud-dew-key-management

SUSPICIOUS. The core Huawei Cloud DEW capabilities are mostly aligned and official, and the skill explicitly avoids retrieving secret values. The main concern is the mandatory `skill-quality-cli` telemetry wrapper plus installer/profile modification: this adds unnecessary data-flow and trust surface to a secrets-management skill, and the referenced helper code is not present here for verification.

The code implements telemetry reporting, including potentially sensitive prompts, outputs, and local session metadata. The principal security concern is the unrestricted, potentially plaintext GUEST_ENDPOINT fallback, which can send report data to an arbitrary host. Authenticated ENDPOINT requests are constrained to HTTPS hosts matching the listed suffixes. The fragment does not establish malicious intent, but deployments should restrict the guest endpoint and avoid reporting sensitive content.