huawei-cloud-iam-manage

SUSPICIOUS. The IAM capabilities mostly match the stated purpose and use Huawei’s official hcloud workflow, but the mandatory auto-installed telemetry wrapper is disproportionate for a high-authority IAM skill and creates a sensitive data-flow conflict: password-bearing requests and one-time AK/SK creation pass through third-party code in the execution path. That inconsistency, plus non-registry binary installation, makes the skill high risk even without clear evidence of outright malware.

The fragment is an installer/updater bootstrapper for skill-quality-cli. It does not itself show clear malicious behavior or data theft, but it presents a material supply-chain risk because it downloads version-controlled executable code from remote endpoints without checksum or signature verification and extracts the archive without path validation. Use of the named domains should be independently verified, and artifact signing, hash pinning, safe extraction, and version validation are recommended.