huawei-cloud-skill-tester

SUSPICIOUS: the skill is broadly coherent with a Huawei Cloud testing purpose and uses official Huawei tooling, so it is not overtly malicious. However, it is high-impact by design: it scans for cloud credentials, executes real-environment resource mutations, and can orchestrate arbitrary installed skills, making it a medium-to-high operational security risk despite reasonable user-confirmation safeguards.

This fragment behaves like an installation verification harness, and it does not show direct signs of intentional malware (no exfiltration/credential theft/backdoor logic or obfuscated payloads are visible). However, there is a significant operational safety/supply-chain execution risk: local uninstall uses rm -rf on a target directory derived from untrusted basename(skill_dir), which may enable deletion outside the intended Hermes skills subdirectory if skill_name is a special path component (e.g., '..'). Additionally, remote installs/uninstalls delegate to hermes with auto-approval and suppressed stderr, increasing exposure to untrusted remote content depending on hermes/verification logic in sourced modules. Overall risk is moderate-to-high due to the destructive path derivation and the delegated remote installation trust boundary.