huawei-cloud-vod-collector

The skill is coherent in purpose—capture and submit Huawei Cloud feedback—but its trust boundary expands significantly during delivery. The main concern is the installation and use of AtomGit-GO from a not-clearly-official publisher namespace, combined with token handling and external issue submission; this makes the skill suspicious/high-risk from a supply-chain and credential-forwarding perspective, though not confirmed malware.

No strong evidence of intentional malware in this fragment. The primary security risk is credential/token exposure due to placing the AtomGit access token in the GitCode request URL as a query parameter (plus potential token emission in returned JSON/CLI output). Secondary supply-chain/runtime risk comes from starting a locally discovered server binary without integrity verification. Aside from these issues, the module’s behavior aligns with a legitimate automation workflow (create issues with feedback content and update local delivery status).

This fragment is not obviously malicious at the PowerShell level; it does not contain overt backdoor/exfiltration logic or obfuscated execution. However, it performs a high-risk supply-chain action: it clones a hardcoded, unpinned remote repository and immediately compiles its contents into Windows executables installed under a user execution path. Without commit/tag pinning and integrity/signature/hash verification, the script could produce and install malware if the remote repository (or its served content) is compromised or malicious.

This script is primarily a high-impact supply-chain installer: it downloads an unpinned remote repository and extracts an unverified tar.gz artifact directly into ~/.local/bin, then enables executables and may set up a compatibility symlink. While the script itself contains no obvious backdoor/exfiltration logic, its lack of integrity verification and tar safety hardening makes it a significant risk if the remote repository or artifact is tampered with (trojanized binaries possible).