huawei-cloud-optv-solver-assistant

SUSPICIOUS: The core purpose, Huawei domains, and KooCLI install source are mostly consistent with a legitimate OptVerse workflow, so this is not fundamentally incompatible or overtly malicious. However, the skill requires the agent to read raw IAM credentials from a local file, forward them into an unreviewed local script for token minting, and it documents optional confirmation skipping and weaker TLS practices; these trust and credential-handling choices are disproportionate enough to warrant caution.

The code implements an expected Huawei Cloud OptVerse automation workflow and does not show clear malware behavior. It has a high-impact transport security weakness because TLS verification is disabled for credential and file-transfer requests, and it has a potential path traversal/arbitrary file-write issue when saving server-supplied artifact filenames. Restrict hcloud executable selection to trusted binaries and validate downloaded paths with basename or canonical containment checks.

The code appears to be a functional OptVerse/Huawei Cloud API client rather than malware. It intentionally handles IAM credentials and tokens for authentication and sends chat data to cloud endpoints. The use of verify=False for authentication and API requests is a significant transport-security vulnerability, and plaintext token caching plus request-body logging can expose secrets or user data. Review and remediation are recommended before production use, especially enabling certificate verification, securing cache permissions, avoiding sensitive request logging, and restricting allowed endpoints.

The supplied document is installation and configuration guidance, not malware. No direct malicious behavior or credential exfiltration is shown. It presents security risks by handling cloud credentials through command-line arguments and environment variables, omitting download checksum/signature verification, and recommending disabling TLS certificate verification. The TLS bypass should be removed or tightly limited, and credentials should be managed with least privilege and a secure secret store.