huawei-cloud-voucher-assistant

SUSPICIOUS. The core Huawei API use and credential scope are mostly consistent with a voucher-assistant purpose, and the referenced network endpoints appear Huawei-owned. However, the undocumented external CLI requirement, telemetry wrapping, and missing bundled installer/client code prevent full verification and make the actual execution footprint broader than a simple read-only discount advisor.

The fragment is an installer/updater bootstrapper for skill-quality-cli. It does not itself show clear malicious behavior or data theft, but it presents a material supply-chain risk because it downloads version-controlled executable code from remote endpoints without checksum or signature verification and extracts the archive without path validation. Use of the named domains should be independently verified, and artifact signing, hash pinning, safe extraction, and version validation are recommended.