huawei-cloud-modelarts-vllm-ascend-model-deploy

This script configures and launches distributed vLLM Ascend inference and shows no clear malicious intent or credential theft. On slave nodes it starts an unauthenticated HTTP file server on port 8080 rooted at the current working directory, which can expose accessible files; it also enables model-supplied code execution with --trust-remote-code and binds the API to 0.0.0.0. These are security risks whose practical severity depends on network access, working-directory contents, model trust, and external access controls; no suspicious domains, URLs, IPs, or credential targets are present in the fragment.

该片段是华为云部署权限与 IAM token 获取说明，未见明确恶意行为。主要风险是请求设置 verify=False，导致 IAM 凭据和 token 面临 TLS 中间人截获风险；示例还会将完整 token 输出到终端。IAM endpoint 为 iam.<region>.myhuaweicloud[.]com，且部分策略使用 Resource:*。总体为中等安全风险，建议启用 TLS 证书验证并避免打印或记录 token。