Security audit
Security checks across malware telemetry and agentic risk
This skill creates privileged root SSH access to cloud servers and deliberately keeps an active SSH path after key cleanup.
Install only if you intentionally want an agent to create temporary root SSH access to Huawei Cloud ECS instances, modify root authorized_keys, and keep an active SSH ControlMaster session after key cleanup. Prefer a non-root account, require explicit approval before running, review the generated SSH config and cleanup logs, terminate the ControlMaster session when done, and avoid long-lived AK/SK exports in shared shells.
**Mandatory.** Start a background timer that fires after `cleanup_delay` seconds (default: 60): 1. Remove `coc-temp-key` line from remote `/root/.ssh/authorized_keys` 2. Delete the COC script via `DeleteScript` 3. Delete local key files from `<temp_dir>/`
"name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0""name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0"# Remove public key from remote ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ -o ConnectTimeout=5 -i <temp_dir>/coc_ssh_key root@<EIP> \ "sed -i \"/coc-temp-key/d\" /root/.ssh/authorized_keys" 2>/dev/null || true # Delete COC script <hcloud> COC DeleteScript --script_uuid="<script_uuid>" 2>/dev/null || true # Delete local keys
| Check | Method | |--------|--------| | 60s timer started | Agent announces cleanup countdown and PID | | Remote key removed | `sed -i '/coc-temp-key/d' /root/.ssh/authorized_keys` executed on target | | COC script deleted | `DeleteScript --script_uuid="<uuid>"` exits 0 | | Local keys deleted | `<temp_dir>/coc_ssh_key` and `.pub` no longer exist | | Fallback ready | If SSH removal fails, COC cleanup script is created and executed |
- The COC script is created via `--cli-jsonInput` with a JSON file, not inline `--content="..."` — inline quoting causes parsing errors with shell special characters in the script body - The COC script is **parameterized** with `PUBLIC_KEY` — it persists across invocations and can deploy different keys - If the COC script already exists from a previous run, it is **reused** rather than recreated - The cleanup uses `nohup bash -c '...' &` + `disown` to survive parent shell exit; output is logged to `<temp_dir>/coc_cleanup.log` for verification. The old `(sleep N && ...) &` pattern loses stdout when the parent shell exits in non-interactive mode - Private keys are stored in `<temp_dir>` and should never be committed to VCS - The `sed` cleanup target `coc-temp-key` matches the key comment set during `ssh-keygen` - After cleanup, use `ssh <EIP>` (no key file needed) — ControlMaster socket handles authentication
"name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0"VirusTotal findings are pending for this skill version.
No suspicious patterns detected.