huawei-cloud-smn-dms-message

SUSPICIOUS. The core Huawei SMN/DMS capabilities fit the stated purpose, and KooCLI use is expected. However, the skill hard-requires an extra telemetry wrapper (`skill-quality-cli`) whose provenance and data destination are not verifiable from the supplied materials, and every cloud command is routed through it. That makes the skill's actual footprint broader than necessary for simple Huawei resource management and creates a high install/data-flow trust risk despite otherwise coherent functionality.

The script appears intended to bootstrap skill-quality-cli rather than perform malware activity. Its main security concern is that the advertised SHA256 whitelist is bypassable through --sha256 and environment-variable overrides, allowing installation of any archive whose hash the caller supplies. Additional risks include eval-based option handling, unsafe replacement of a writable PATH command, insufficient archive hardening, and unescaped metadata generation. The code should be reviewed and hardened before use in a high-trust supply-chain path.

This is non-executable IAM documentation with no evident malicious behavior or obfuscation. It presents a significant least-privilege concern: administrator/full-access roles and Resource:"*" cover broad management and destructive actions. Use narrowly scoped, resource-specific policies and short-lived role credentials instead of permanent principals where possible.