huawei-cloud-kubectl-cce-installer

SUSPICIOUS: the local-install purpose is coherent, but the actual install footprint is not fully aligned with trustworthy distribution paths. Official Kubernetes downloads are expected, yet the skill adds a Huawei OBS kubectl source not supported by the cited Huawei docs and relies on a third-party/personal-looking Gitee project for kubectl-cce, including source-build fallback. No direct credential exfiltration is described, but supply-chain risk is high enough to treat this skill as suspicious rather than benign.

No explicit malicious behavior (e.g., credential theft, exfiltration, backdoor/persistence, reverse shells) is evident in the provided fragment. The code’s main security exposure is supply-chain risk: it downloads and installs kubectl and a kubectl-cce release tarball (and can build from fetched source) without visible checksum/signature verification or tarball safety hardening in this snippet. Review the helper functions and upstream provenance controls (artifact integrity validation, source pinning, safe extraction settings, and trust for BIN_DIR) to determine whether the installer can be subverted.