huawei-cloud-optv-solver-assistant

This is an OptVerse API client that reads IAM credentials, obtains and caches a token, and submits the requested chat message. No clear malicious behavior is evident, but disabling TLS verification exposes the token and message to interception, and the plaintext token cache increases local credential exposure. The token is sent to https://{endpoint}/v1/{project_id}/chats, where the endpoint defaults to optverse.cn-east-3.myhuaweicloud.com but can be overridden; severity is moderate due to these credential-handling risks.

This is a cloud workflow client, with no clear evidence of intentional malware or credential theft. Security risk is elevated by disabled TLS verification for requests carrying an IAM token, and by unvalidated remote filenames that can write outside the artifacts directory. Task-response URLs are also fetched without destination allowlisting, creating an SSRF risk if those responses are untrusted. The configured endpoint is optverse.<region>.myhuaweicloud[.]com; no other fixed domain or credential value is embedded.