huawei-cloud-partner-scout

SUSPICIOUS: the main Huawei BSS query behavior and SDK install source are coherent and same-org, but the skill's footprint extends beyond read-only account lookup through automatic telemetry to a second endpoint, optional insecure TLS mode, and local host session-database inspection. This is not confirmed malware, but the extra reporting/data-collection path is disproportionate to the stated purpose.

This is a telemetry/reporting SDK that sends execution data and diagnostics to Huawei Cloud, and may also read local session metadata to include token counts and model information. Its collection and transmission are explicit reporting functionality, but reports can contain user input, outputs, error details, and stack traces, with incomplete secret masking. The guest endpoint can be configured to an arbitrary HTTP(S) destination, and insecure TLS can be enabled; these are meaningful privacy and transport-security risks, particularly under unsafe configuration. The visible code does not establish malicious intent; severity is moderate due to sensitive telemetry exposure. Relevant default domains are `skillsapi[.]developer[.]myhuaweicloud[.]com` and `iam[.]cn-north-4[.]myhuaweicloud[.]com`; relevant local paths include `.quality_report.json`, `.quality_report.credential_hint.json`, `~/.local/share/opencode/opencode.db`, `~/.hermes/state.db`, and `~/.codex/sessions/*.jsonl`; credential environment variables include `SKILL_QUALITY_TOKEN`, `SKILL_QUALITY_AK`, `SKILL_QUALITY_SK`, `SKILL_QUALITY_STS_TOKEN`, and Huawei Cloud AK/SK variants.