huawei-cloud-ecs-passwordless-login

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

This skill sets up SSH access but also preserves privileged access after cleanup and changes local SSH behavior, so it should be reviewed carefully before installation.

Install only if you explicitly want the agent to create temporary root SSH credentials and keep an active SSH session after key cleanup. Before use, require opt-in for ControlMaster persistence, use a least-privileged account where possible, keep ControlPersist short, remove the added SSH config entry and socket after use, verify /root/.ssh/authorized_keys cleanup succeeds, and avoid exposing Huawei Cloud AK/SK credentials in shared shells or logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill markets the workflow as temporary passwordless access with cleanup, but it explicitly preserves ongoing SSH access by establishing a ControlMaster session before removing the key. This is dangerous because it defeats the security meaning of cleanup and leaves a covert authenticated channel active after the advertised access revocation point.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Appending a Host block to ~/.ssh/config creates a persistent local side effect unrelated to the minimum needed to test a temporary key deployment. Because it also disables host key verification for that host, it can weaken future SSH security and silently alter later connections beyond the immediate task.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation claims security cleanup removes keys from local and remote systems, but elsewhere states the agent can still connect after cleanup via ControlMaster. This is deceptive and dangerous because operators may believe access has been revoked when an authenticated session remains usable.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill normalizes retained SSH connectivity after key removal without a prominent warning that cleanup does not end access. In context, this is especially dangerous because the workflow operates on root SSH access to cloud instances, so understated persistence materially increases the chance of unnoticed long-lived access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs silent modification of ~/.ssh/config without clearly warning that this change persists locally after the task completes. This can affect future SSH behavior and weaken trust-on-first-use protections by keeping StrictHostKeyChecking disabled for the target host.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The guide instructs users to export long-lived cloud credentials as environment variables without any warning about exposure risks. Environment variables can be leaked through shell history, process inspection, debugging output, CI logs, or inherited subprocesses, which is particularly sensitive here because the skill manages IAM/COC operations against Huawei Cloud infrastructure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The verification guidance includes destructive cleanup actions that modify root SSH access and delete authentication material, but it does not require an explicit warning, confirmation, or rollback guidance before those actions occur. In a skill that automates temporary privileged access, silent cleanup can lock out operators, remove expected access paths, or alter production systems in ways the user did not fully anticipate.

Ssd 4

High

• Confidence: 99% confidence
• Finding: The workflow uses a temporary-access narrative while intentionally retaining continued SSH connectivity after removal of the deployed key. That pattern is characteristic of covert persistence because it preserves privileged access while making the system appear cleaned up to the operator.

Ssd 4

High

• Confidence: 99% confidence
• Finding: These instructions explicitly establish continued SSH access after authentication material is removed, creating an active session that outlives the supposed cleanup. In the context of root access to cloud ECS instances, this is a strong persistence mechanism that can conceal ongoing administrative control.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The best-practices and verification sections reinforce post-cleanup access retention as expected success, which normalizes deceptive persistence behavior. This increases danger because operators may validate the workflow based on continued access rather than true revocation, masking the residual security exposure.

Credential Access

High

• Category: Privilege Escalation

Content

**Mandatory.** Start a background timer that fires after `cleanup_delay` seconds (default: 60):

1. Remove `coc-temp-key` line from remote `/root/.ssh/authorized_keys`
2. Delete the COC script via `DeleteScript`
3. Delete local key files from `<temp_dir>/`

• Confidence: 94% confidence
• Finding: The workflow directly manipulates /root/.ssh/authorized_keys, which is a high-sensitivity credential store controlling privileged remote access. In this skill's context, writing and later editing this file grants and manages root login capability, so misuse or unexpected persistence can lead to unauthorized administrative access.

Credential Access

High

• Category: Privilege Escalation

Content

"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

• Confidence: 98% confidence
• Finding: Modifying /root/.ssh/authorized_keys through automation grants privileged credential access and can be abused to implant backdoor SSH entry. Given the surrounding instructions to retain access after key removal, the context substantially increases the severity beyond a routine admin operation.

Credential Access

High

• Category: Privilege Escalation

Content

"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

• Confidence: 98% confidence
• Finding: Modifying /root/.ssh/authorized_keys through automation grants privileged credential access and can be abused to implant backdoor SSH entry. Given the surrounding instructions to retain access after key removal, the context substantially increases the severity beyond a routine admin operation.

Credential Access

High

• Category: Privilege Escalation

Content

# Remove public key from remote
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o ConnectTimeout=5 -i <temp_dir>/coc_ssh_key root@<EIP> \
  "sed -i \"/coc-temp-key/d\" /root/.ssh/authorized_keys" 2>/dev/null || true
# Delete COC script
<hcloud> COC DeleteScript --script_uuid="<script_uuid>" 2>/dev/null || true
# Delete local keys

• Confidence: 91% confidence
• Finding: The cleanup step remotely edits /root/.ssh/authorized_keys over SSH, confirming the skill's control over the target's root credential store. While framed as cleanup, it still demonstrates privileged credential manipulation and is risky because failure is ignored with '|| true', so cleanup may silently not occur.

Session Persistence

Medium

• Category: Rogue Agent

Content

ssh -N -f <EIP> -i <temp_dir>/coc_ssh_key && echo "MASTER_CONNECTED"
ssh <EIP> "echo SSH_MUX_OK"  # verify multiplexing works

# 7. Security cleanup (background, survives parent shell exit via nohup + disown)
nohup bash -c '
sleep <cleanup_delay>
# Remove public key from remote

• Confidence: 86% confidence
• Finding: Using nohup to keep background activity alive after the parent shell exits creates execution persistence on the local system. In context, this supports deferred cleanup, but persistence combined with silent error suppression and ongoing SSH access makes behavior harder to audit and control.

Session Persistence

Medium

• Category: Rogue Agent

Content

ssh <EIP> "echo SSH_MUX_OK"  # verify multiplexing works

# 7. Security cleanup (background, survives parent shell exit via nohup + disown)
nohup bash -c '
sleep <cleanup_delay>
# Remove public key from remote
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \

• Confidence: 86% confidence
• Finding: The detached nohup bash cleanup job persists independently of the invoking shell, which can make privileged operations continue outside normal session control. This increases operational risk because users may lose visibility into whether cleanup, deletion, or remote credential changes actually completed.

Session Persistence

Medium

• Category: Rogue Agent

Content

- The COC script is created via `--cli-jsonInput` with a JSON file, not inline `--content="..."` — inline quoting causes parsing errors with shell special characters in the script body
- The COC script is **parameterized** with `PUBLIC_KEY` — it persists across invocations and can deploy different keys
- If the COC script already exists from a previous run, it is **reused** rather than recreated
- The cleanup uses `nohup bash -c '...' &` + `disown` to survive parent shell exit; output is logged to `<temp_dir>/coc_cleanup.log` for verification. The old `(sleep N && ...) &` pattern loses stdout when the parent shell exits in non-interactive mode
- Private keys are stored in `<temp_dir>` and should never be committed to VCS
- The `sed` cleanup target `coc-temp-key` matches the key comment set during `ssh-keygen`
- After cleanup, use `ssh <EIP>` (no key file needed) — ControlMaster socket handles authentication

• Confidence: 83% confidence
• Finding: The notes explicitly recommend nohup/disown to survive parent exit and also state access remains possible after cleanup through ControlMaster. Together these normalize both process persistence and session persistence, which increases the chance of unnoticed residual access.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Delete COC script
<hcloud> COC DeleteScript --script_uuid="<script_uuid>" 2>/dev/null || true
# Delete local keys
rm -f <temp_dir>/coc_ssh_key <temp_dir>/coc_ssh_key.pub
echo "COC SSH keys cleaned up. Existing SSH sessions remain unaffected."
' > <temp_dir>/coc_cleanup.log 2>&1 &
disown

• Confidence: 84% confidence
• Finding: The command deletes files under a parameterized <temp_dir> path without documenting strict validation of that path. If the parameter were malformed, empty, or unexpectedly expanded, cleanup commands could target unintended filesystem locations, turning a cleanup step into a destructive local action.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

• Confidence: 99% confidence
• Finding: The script content matches a classic SSH backdoor pattern: append a key to root authorized_keys and set permissions so remote access works. In this skill's context, the later preservation of active access after apparent cleanup makes the backdoor-persistence characterization substantially credible rather than a mere false positive.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.