huawei-cloud-sg-manage

SUSPICIOUS. The main purpose and Huawei Cloud capabilities are coherent, and hcloud appears to be the official vendor CLI. The concern is the mandatory telemetry wrapper and auto-install path for skill-quality-cli, whose provenance is less verifiable and adds a non-essential credential-adjacent data flow beyond the stated cloud-management task. This is not confirmed malware, but it is higher-risk than a pure direct-to-official-CLI skill.

The fragment is an installer/updater bootstrapper for skill-quality-cli. It does not itself show clear malicious behavior or data theft, but it presents a material supply-chain risk because it downloads version-controlled executable code from remote endpoints without checksum or signature verification and extracts the archive without path validation. Use of the named domains should be independently verified, and artifact signing, hash pinning, safe extraction, and version validation are recommended.