Security audit
Security checks across malware telemetry and agentic risk
The skill openly automates cloud server SSH access, but it keeps privileged access alive after the advertised cleanup and makes broad SSH and cloud-account changes.
Install only if you intentionally want an agent to create root SSH access to Huawei Cloud ECS instances. Use a dedicated project/account, verify the target host and SSH host key yourself, avoid long-lived AK/SK credentials on shared machines, prefer non-root access where possible, and manually verify removal of the remote key, COC script, SSH config entry, ControlMaster socket/process, and any broad IAM agency permissions after use.
**Mandatory.** Start a background timer that fires after `cleanup_delay` seconds (default: 60): 1. Remove `coc-temp-key` line from remote `/root/.ssh/authorized_keys` 2. Delete the COC script via `DeleteScript` 3. Delete local key files from `<temp_dir>/`
"name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0""name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0"# Remove public key from remote ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ -o ConnectTimeout=5 -i <temp_dir>/coc_ssh_key root@<EIP> \ "sed -i \"/coc-temp-key/d\" /root/.ssh/authorized_keys" 2>/dev/null || true # Delete COC script <hcloud> COC DeleteScript --script_uuid="<script_uuid>" 2>/dev/null || true # Delete local keys
ssh -N -f <EIP> -i <temp_dir>/coc_ssh_key && echo "MASTER_CONNECTED" ssh <EIP> "echo SSH_MUX_OK" # verify multiplexing works # 7. Security cleanup (background, survives parent shell exit via nohup + disown) nohup bash -c ' sleep <cleanup_delay> # Remove public key from remote
ssh <EIP> "echo SSH_MUX_OK" # verify multiplexing works # 7. Security cleanup (background, survives parent shell exit via nohup + disown) nohup bash -c ' sleep <cleanup_delay> # Remove public key from remote ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
- The COC script is created via `--cli-jsonInput` with a JSON file, not inline `--content="..."` — inline quoting causes parsing errors with shell special characters in the script body - The COC script is **parameterized** with `PUBLIC_KEY` — it persists across invocations and can deploy different keys - If the COC script already exists from a previous run, it is **reused** rather than recreated - The cleanup uses `nohup bash -c '...' &` + `disown` to survive parent shell exit; output is logged to `<temp_dir>/coc_cleanup.log` for verification. The old `(sleep N && ...) &` pattern loses stdout when the parent shell exits in non-interactive mode - Private keys are stored in `<temp_dir>` and should never be committed to VCS - The `sed` cleanup target `coc-temp-key` matches the key comment set during `ssh-keygen` - After cleanup, use `ssh <EIP>` (no key file needed) — ControlMaster socket handles authentication
"name": "coc_ssh_key_setup",
"type": "SHELL",
"description": "Deploy SSH public key for passwordless login",
"content": "#!/bin/bash\nset -e\nmkdir -p /root/.ssh && chmod 700 /root/.ssh\necho $PUBLIC_KEY >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\necho KEY_DEPLOYED_SUCCESSFULLY",
"properties": {
"risk_level": "LOW",
"version": "1.0.0"63/63 vendors flagged this skill as clean.
No suspicious patterns detected.