中文 EN
Start Review
Skill Trust Decision

huawei-cloud-devbridge-tunnel

华为云开发隧道工具，依赖危险的 `curl|bash` 远程脚本执行模式安装CLI，但未发现恶意代码或数据外泄行为。核心脚本是良性的适配层，无阴影功能。

Install decision first Source: ClawHub Scanned: Aug 11, 2026
Files 9
Artifacts 8
Violations 0
Findings 3
Most direct threat evidence
Critical Dangerous Command
curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash

Why this conclusion was reached

1/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

3 high-risk artifacts or egress signals were extracted.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

curl|bash远程脚本执行 +15

SKILL.md多处声明通过curl|bash安装CLI，属于危险的远程代码执行模式（虽然对CLI工具较常见）

潜在的rm -rf风险 +10

卸载文档包含 rm -rf ~/.huawei/devbridge，虽为合法卸载操作但存在误操作风险

Most important evidence

Medium Supply Chain

CLI安装依赖远程脚本执行

通过 `curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash` 安装CLI工具，这是危险的远程代码执行模式。虽然对CLI安装工具较常见，但存在供应链攻击风险。

SKILL.md:87
建议使用版本锁定的离线安装方式或验证脚本哈希
Low RCE

卸载指令包含rm -rf操作

cli-installation-guide.md中的卸载指令包含 `rm -rf ~/.huawei/devbridge`，虽然这是合法卸载操作，但如果脚本或命令被篡改，可能造成数据损失。

references/cli-installation-guide.md:137
确认用户意图后再执行删除操作
Low Supply Chain

Windows安装使用Invoke-Expression

Windows安装使用 `irm ... | iex` 远程脚本执行模式，同样存在供应链风险。

references/cli-installation-guide.md:38
确认PowerShell安装脚本来源可信

Declared capability vs actual capability

Shell Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:87 - curl|bash安装脚本
Filesystem Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:86 - 写入 ~/.huawei/bin
Network Pass
Declared READ
→
Inferred READ
SKILL.md:88 - 访问华为云CDN下载CLI
Environment Pass
Declared READ
→
Inferred READ
references/iam-policies.md:51 - 读取DEVBRIDGE_AK/SK环境变量

Suspicious artifacts and egress

Critical Dangerous Command
curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash

SKILL.md:87

Critical Dangerous Command
rm -rf ~

references/cli-installation-guide.md:137

Critical Dangerous Command
curl --proxy <proxy-url> -fsSL <install-url> | bash

references/cli-installation-guide.md:161

Medium External URL
https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh

SKILL.md:87

Medium External URL
https://noh56s7x-8080.cn-north-4-bridge.myhuaweicloud.com

SKILL.md:306

Medium External URL
https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.ps1

references/cli-installation-guide.md:36

Medium External URL
https://devbridge.

references/rest-api-reference.md:8

Medium External URL
https://res-hd.hc-cdn.cn

references/troubleshooting.md:58

Dependencies and supply chain

There are no structured dependency warnings.

File composition

9 files · 2678 lines
Markdown 8 files · 2319 linesShell 1 files · 359 lines
Files of concern · 4
SKILL.md Markdown · 402 lines
CLI安装依赖远程脚本执行 · curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash · https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh · https://noh56s7x-8080.cn-north-4-bridge.myhuaweicloud.com
references/troubleshooting.md Markdown · 347 lines
https://res-hd.hc-cdn.cn
references/rest-api-reference.md Markdown · 361 lines
https://devbridge.
references/cli-installation-guide.md Markdown · 161 lines
卸载指令包含rm -rf操作 · Windows安装使用Invoke-Expression · rm -rf ~ · curl --proxy <proxy-url> -fsSL <install-url> | bash · https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.ps1
Other files · devbridge_cmd.sh · acceptance-criteria.md · cli-command-reference.md · iam-policies.md · verification-method.md

Security positives

核心代码(scripts/devbridge_cmd.sh)无恶意行为，是纯良性的CLI适配层
无阴影功能：所有操作均在文档中声明
未发现凭证收割、远程代码执行后门或数据外泄
认证采用华为云标准IAM体系，凭证存储在~/.huawei/devbridge/
代码无Base64编码、eval()执行或混淆技术
未访问敏感路径如~/.ssh、~/.aws、.env等