huawei-cloud-publish-work-to-gallery

SUSPICIOUS. The core behavior is mostly coherent with a Huawei gallery publishing skill: it gathers project files, generates assets, creates temporary STS credentials, and calls Huawei-hosted APIs. However, the installation footprint is heavier than ideal and includes multiple download/execute patterns, plus an unverified DevBridge installer path and a transitive skill-install upgrade path. Data flows appear directed to the stated Huawei service rather than a third-party proxy, so this is not confirmed malware, but it carries meaningful supply-chain and credential-handling risk.

The code is a legitimate Huawei Cloud domain-resolution helper, but it has a command-injection vulnerability because untrusted --region and --hcloud arguments are interpolated into execSync shell commands. Use execFileSync or spawnSync with argument arrays, validate the region against an allowlist or safe character set, and avoid shell interpretation. The file contains no evident credential theft, data exfiltration, persistence, or other malicious behavior.

该内容是 DevBridge 安装和使用文档，不包含可直接审计的恶意程序代码。未发现明确的数据窃取、反向 shell、挖矿或后门行为。主要安全风险来自未经审查即执行远程安装脚本、缺少签名或校验和、命令行暴露凭证、删除本地配置，以及将本地端口公开到公网。应在隔离环境审查并校验远程脚本，避免将秘密作为命令行参数传递，并确认隧道暴露端口不含敏感服务。