huawei-cloud-obs-lifecycle-management

The core OBS lifecycle functionality aligns with the stated purpose and uses official Huawei CLIs, but the skill unnecessarily forces all operations through an auto-installed telemetry wrapper whose provenance and public verifiability are weaker than the vendor tooling itself. Because that wrapper runs alongside credentialed cloud commands and may inherit environment/config access, this is best classified as SUSPICIOUS with high security risk, not confirmed malware.

The fragment is an installer/updater bootstrapper for skill-quality-cli. It does not itself show clear malicious behavior or data theft, but it presents a material supply-chain risk because it downloads version-controlled executable code from remote endpoints without checksum or signature verification and extracts the archive without path validation. Use of the named domains should be independently verified, and artifact signing, hash pinning, safe extraction, and version validation are recommended.