huawei-cloud-network-topology-audit

Overall the skill is mostly coherent with its stated read-only Huawei Cloud audit purpose. The main concern is the bundled quality-reporting SDK: it collects execution metadata, uses credential-derived IAM auth, can post to a separate Huawei skills endpoint, and optionally disables TLS verification. Install sources appear official and proportionate, so this is better classified as suspicious/medium risk than malicious.

The code is an explicit cloud telemetry SDK rather than an apparent covert backdoor. Its main security concern is intentional collection and network transmission of function inputs, outputs, errors, and stack traces, combined with use of cloud credentials and a configurable destination. Secret masking is incomplete, and the optional insecure TLS mode can expose credentials and reports to interception. The configurable endpoint also creates a potential exfiltration path if deployment environment variables are attacker-controlled. No clear destructive or covert malware behavior is evident. As supplied, the fragment also has a syntax error due to the unterminated self_check call.