huawei-cloud-skill-creator

SUSPICIOUS: the core Huawei Cloud research/scaffolding behavior is aligned with the stated purpose, and official Huawei CLI/SDK usage looks legitimate. The main concerns are mandatory installation of an external wrapper CLI, forced routing of all CLI calls through that wrapper, and mandatory telemetry/reporting through a reporter component whose public provenance and exact data flow are not fully verifiable; this is disproportionate for a skill generator even if Huawei-owned infrastructure is likely involved.

The fragment implements telemetry reporting for AI-agent activity and is not overtly malicious: it contains no obfuscation, command execution, persistence, or destructive behavior. However, it automatically harvests sensitive local session content and credentials and transmits prompts, outputs, tool steps, and metadata externally. The arbitrary guest endpoint configuration is a notable exfiltration risk because it is not restricted to trusted Huawei domains. Deployment should require explicit user consent, minimize collected content, protect credential access, and strictly validate or disable GUEST_ENDPOINT.

The fragment appears to implement a telemetry/reporting CLI with remote package installation and automatic upgrades. No direct malware behavior is demonstrated in the supplied code, but it has meaningful security risk: it executes arbitrary requested commands, collects potentially sensitive configuration and output, reports data remotely through an unseen module, and automatically installs native binaries from a server-controlled endpoint. The exact exfiltration scope cannot be confirmed without cli_reporting.py and the server behavior. The provided fragment is also syntactically invalid because WRAPPER_SCRIPT has no assigned value.

The script appears intended as a cloud CLI/SDK/API functional test tool, not as overt malware. However, it has a high command-injection risk because test-vars.json commands are executed via bash -c after an inadequate prefix allowlist. A malicious or compromised skill can execute arbitrary local commands, access credentials, and make arbitrary network requests. The curl path and live cloud execution further increase impact. Test commands should be parsed into fixed argument arrays, restricted to explicit operations and approved hosts, and mutation operations should be blocked by default.

The fragment does not contain confirmed malware, but it defines a high-impact automatic software-update and execution mechanism. The shown fallback installs a remotely downloaded executable into ~/.local/bin without displaying an actual checksum verification step, and the reporting design may transmit session/user-input metadata externally. The implementation, artifact authenticity, permissions, and reporting payload should be independently audited before use. The degraded bare-hcloud fallback also conflicts with the stated enforcement rule.

The fragment is a readable scaffolding script with an intended quality-reporting wrapper and no evident malware or direct data exfiltration. It has a meaningful code-injection risk because the user-controlled skill name is interpolated into generated shell code without escaping or validation. The copied and executed helper files require separate review, especially because ensure_cli.sh failures are hidden.

This is an automatic remote-code installer. The fragment does not directly show data theft, persistence beyond installing the CLI, or destructive behavior, but it creates a significant supply-chain risk because it installs unsigned, dynamically selected binaries and Python modules from remote endpoints without integrity verification. The package or hosting service could replace the downloaded contents and gain code execution when the CLI is used. Archive path traversal is also not mitigated.