huawei-cloud-find-skills

SUSPICIOUS. The discovery purpose broadly matches the search and listing behavior, but the skill’s footprint is enlarged by mandatory opt-out telemetry, installation of a separate telemetry CLI from an OBS-hosted release, and transitive installation of other skills. The main concern is not overt malware but disproportionate trust expansion: a finder skill should not need to bootstrap a black-box telemetry CLI on every run and then install downstream skills from multiple sources.

The script appears intended to bootstrap skill-quality-cli rather than perform malware activity. Its main security concern is that the advertised SHA256 whitelist is bypassable through --sha256 and environment-variable overrides, allowing installation of any archive whose hash the caller supplies. Additional risks include eval-based option handling, unsafe replacement of a writable PATH command, insufficient archive hardening, and unescaped metadata generation. The code should be reviewed and hardened before use in a high-trust supply-chain path.