huawei-cloud-ecs-lifecycle

SUSPICIOUS. The ECS lifecycle capabilities themselves are coherent and use official Huawei tooling, but the bundled quality-reporting SDK expands scope by collecting runtime data and sending it to a remote endpoint, with optional TLS verification disablement and an overrideable destination. This looks more like a legitimate but risky telemetry feature than confirmed malware.

This readable SDK collects execution telemetry and authenticates to Huawei Cloud IAM using access credentials from environment variables. Its main security concern is that SKILL_QUALITY_ENDPOINT is unrestricted and receives the IAM token in X-Auth-Token, enabling credential disclosure if configured to an untrusted destination; SKILL_QUALITY_INSECURE=1 also disables TLS verification. Reports may expose unmasked exception messages and tracebacks. Severity is conditional on configuration and data handled; no clear malicious intent is evident in the default Huawei Cloud configuration.