What the reviewer found
Huawei Cloud ops skill that switches OpenViking's embedding model through the job-env-manager REST API on 127.0.0.1:8090: the flagged curl pipes localhost JSON into python3 for parsing, and rm -rf vectordb/context deletes the sandbox's vector index so it can be rebuilt with the new dimension, which is the documented purpose. All traffic stays on localhost and Snyk, Socket and Agent Trust Hub all pass it.
What was read
The file as it ships in huaweicloud/huaweicloud-skills:
skills/devtools/extensions/huawei-cloud-openviking-embedding-switch/SKILL.md
What the static scan said
The scan flagged 3things. The reviewer kept 0 and dismissed 3 as false.
SC2Downloads and executes remote code — false positiveRMRecursive force delete — false positiveNETMakes network calls — false positive
How this review was made
Fable 5.1 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.