pudu-cloudveil-skill

SUSPICIOUS. The skill’s capabilities generally match its stated purpose and the install path looks same-org/normal, so this is not confirmed malware. Risk is elevated because it uses raw credentials, sends them through a local helper script, and authenticates to a user-supplied base URL that is not pinned to a clearly verified official CloudVeil hostname; it also enables real-world robot actions.

The fragment appears to be a legitimate API request helper and contains no clear intentional malware. However, buildUrl() does not constrain requestPath to the configured CloudVeil origin, so an attacker who controls the path or invokes this CLI with an absolute URL may be able to redirect an authenticated request and leak the access token. The base URL and token header are also entirely environment-controlled and should be validated, preferably requiring HTTPS and an allowlisted origin. Restrict request paths to relative API paths and avoid forwarding authentication headers across origins.