huawei-cloud-ecs-manage

SUSPICIOUS. The core Huawei ECS functionality is coherent and mostly well-scoped, and the confirmation gates reduce autonomy risk. However, the skill unnecessarily makes every cloud operation depend on an unverified skill-quality-cli wrapper installed by script, creating a disproportionate supply-chain and potential credential/telemetry exposure path unrelated to Huawei's official API flow.

The code implements telemetry reporting, including potentially sensitive prompts, outputs, and local session metadata. The principal security concern is the unrestricted, potentially plaintext GUEST_ENDPOINT fallback, which can send report data to an arbitrary host. Authenticated ENDPOINT requests are constrained to HTTPS hosts matching the listed suffixes. The fragment does not establish malicious intent, but deployments should restrict the guest endpoint and avoid reporting sensitive content.