ClawHub
Back to skill

Security audit

huawei-cloud-ecs-passwordless-login

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud SSH automation workflow, but it grants and preserves high-impact remote access with unsafe scoping that users should review carefully before installing.

Install only if you are comfortable giving the agent authenticated Huawei Cloud COC/IAM authority and root-level script execution on the selected ECS instances. Before use, require exact target confirmation, avoid root where possible, do not reuse pre-existing COC scripts unless their content is verified, keep host-key verification enabled when feasible, and explicitly close/remove ControlMaster sockets and SSH config entries when access should end.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:69
Finding

Unverified Pre-existing COC Script Is Executed as Root

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-70, 209, and 229
Vulnerability Type: Untrusted cloud document reuse leading to privileged code execution
Risk Level: High

Vulnerable code:

text
1. **Check existing** — Call `ListScripts --cli-region=<coc_region>` with
`--name_like="coc_ssh_key_setup"`. If found, record `script_uuid` and skip step 2.
2. **Create new** — Write a JSON file with the script content, then call
`CreateScript --cli-region=<coc_region> --cli-jsonInput=<file>`.
json
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_param": {
      "execute_user": "root"
    }
  }
}

Technical Analysis

The workflow searches for a COC script using the non-exact name_like filter and reuses a returned script_uuid. If a matching script is found, creation of the Skill's known script body is skipped.

Before execution, the workflow does not require verification of the selected document's exact name, owner, script type, canonical content, parameters, version, or cryptographic digest. The selected document is subsequently executed on the target ECS instances with execute_user set to root.

This creates a trust-boundary violation: script content controlled by another COC document author is treated as if it were the trusted deployment script and receives the invoking user's authority to execute on the selected hosts. The behavior is inconsistent with the intended invariant that the script only installs the generated public key.

Attack Path

  1. An attacker who can create or modify COC documents in the relevant cloud account plants a script matching the coc_ssh_key_setup name filter.
  2. The planted document contains commands chosen by the attacker.
  3. A more privileged user invokes this Skill against ECS instances that the attacker's own permissions do not allow them to administer directly.
  4. `ListScripts ...[truncated 1161 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not reuse a COC script solely because it matches a name_like search.
  • Prefer creating a uniquely named, per-run script and execute only the UUID returned directly by that successful creation request.
  • If reuse is required, use an exact-name lookup and reject zero, duplicate, or ambiguous matches.
  • Before execution, retrieve and validate the complete script definition, including its owner, type, canonical body, parameters, and expected version.
  • Compare the canonical script body against a pinned cryptographic digest and fail closed on any mismatch.
  • Verify that the document contains only the expected PUBLIC_KEY and SSH_USER parameters and that sensitive-field settings match the trusted definition.
  • Apply least privilege: avoid root execution when the requested SSH account and filesystem permissions allow a narrower execution identity.
  • Record the validated document identity and digest in audit output so the operator can confirm exactly what was executed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (30)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises temporary passwordless access with cleanup, but explicitly preserves ongoing SSH access after key removal via ControlMaster. That creates a misleading security model: operators may believe access is revoked after 60 seconds when an authenticated session remains usable for up to the configured persist timeout, effectively extending access beyond the stated cleanup boundary.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill intentionally modifies remote authorized_keys, which is a credential-access mechanism that grants interactive shell access. In this context the behavior is core functionality, but it remains security-sensitive because compromise, misuse, or operator misunderstanding would give the agent direct access to target hosts.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
**Mandatory.** Start a background timer that fires after `cleanup_delay` seconds (default: 60):

1. Remove `coc-temp-key` line from remote `~<ssh_user>/.ssh/authorized_keys` **on every target**
2. Delete the COC script via `DeleteScript --cli-region=<coc_region>`
3. Delete local key files from `<temp_dir>/`

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Appending a public key to authorized_keys grants shell access to the remote account and is therefore a high-sensitivity credential establishment action. In a trusted admin workflow this may be legitimate, but the combination of batch targeting, root default user, and later persistence mechanisms increases the blast radius if misused or triggered on the wrong hosts.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nHOME_DIR=$(eval echo ~$SSH_USER)\nmkdir -p \"$HOME_DIR/.ssh\" && chmod 700 \"$HOME_DIR/.ssh\"\necho $PUBLIC_KEY >> \"$HOME_DIR/.ssh/authorized_keys\"\nchmod 600 \"$HOME_DIR/.ssh/authorized_keys\"\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
97% confidence
Finding

The YARA match is substantively valid because the script performs SSH key injection into authorized_keys, a technique commonly used for persistence and backdoor access. In this skill the action is presented as administrative automation, but the surrounding design makes it more dangerous by supporting batch deployment, optional root access, insecure host verification, and continued access after nominal cleanup.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
(coc_region)
hcloud COC ListScripts --cli-region=<coc_region> --limit=100 --name_like="coc_ssh_key_setup"
# If not found, create a JSON file and use --cli-jsonInput:
cat > <temp_dir>/coc_create.json << 'JSONEOF'
{
  "body": {
    "name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nHOME_DIR=$(eval echo ~$SSH_USER)\nmkdir -p \"$HOME_DIR/.ssh\" && chmod 700 \"$HOME_DIR/.ssh\"\necho $PUBLIC_KEY >> \"$HOME_DIR/.ssh/authorized_keys\"\nchmod 600 \"$HOME_DIR/.ssh/authorized_keys\"\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"
    },
    "script_params": [
      {
        "param_name": "PUBLIC_KEY",
        "param_description": "SSH public key to deploy",
        "param_value": "",
        "sensitive": true
      },
      {
        "param_name": "SSH_USER",
        "param_description": "Target SSH username on the ECS",
        "param_v

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Documenting that the key is deployed to ~/.ssh/authorized_keys confirms the skill uses direct credential injection for access. This is expected for the skill's purpose, but it remains a sensitive technique whose danger is amplified by root support and persistence after nominal cleanup.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
| `ecs_ip`          | Conditional | None         | Comma-separated list of ECS elastic IPv4 addresses. Required if `ecs_instance_id` is not provided. May be mixed with `ecs_instance_id` entries                                                                                         |
| `ecs_region`      | No          | None         | **Removed from target resolution.** Target ECS regions are discovered via `COC ListResources` (which returns each resource's `region_id` without needing it in advance); this parameter is kept only as an optional hint and is **not required** |
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |
| `cleanup_delay`   | No          | `60`         | Seconds to wait before automatic key cleanup (min 10, max 300)                                                                                                                                                                         |
| `persist_timeout`         | No          | `3600`       | Seconds to keep ControlMaster alive after all sessions close (min 60, max 86400)                                                                                                                                                       |
| `server_alive_interval`   | No          | `30`         | Seconds between keepalive packets sent to the remote host to maintain active TCP connection (min 5, max 300)                                                                                                               
...[truncated 24 chars]

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This acceptance criterion explicitly requires deploying an SSH public key into a target user's ~/.ssh/authorized_keys to enable passwordless access. Even though this is the intended function of the skill, it is still a credential-access/persistence mechanism that grants interactive remote access to ECS instances, and if mis-targeted, abused, or cleanup fails, it can leave unauthorized access in place. The batch/multi-host context and automatic agency/script execution make the capability more dangerous because it can scale access across many systems quickly.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 40)May include surrounding context.

md
## SSH Connectivity

- [ ] Non-root `ssh_user` supported: key deployed to `~<ssh_user>/.ssh/authorized_keys` (not just `/root`)
- [ ] Each target `ssh -i <temp_dir>/coc_ssh_key <ssh_user>@<EIP>` connects without password prompt
- [ ] Test command returns `SSH_OK` for every target
- [ ] SSH connection string provided to user for each target

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
| Check | Method |
|--------|--------|
| 60s timer started | Agent announces cleanup countdown and PID |
| Remote key removed (each target) | `sed -i '/coc-temp-key/d' ~<ssh_user>/.ssh/authorized_keys` executed on every target |
| COC script deleted | `DeleteScript --cli-region=<coc_region> --script_uuid="<uuid>"` exits 0 |
| Local keys deleted | `<temp_dir>/coc_ssh_key` and `.pub` no longer exist |
| Fallback ready | If SSH removal fails, COC cleanup script is created and executed for the failed targets only |

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md
| Check | Method |
|--------|--------|
| 60s timer started | Agent announces cleanup countdown and PID |
| Remote key removed (each target) | `sed -i '/coc-temp-key/d' ~<ssh_user>/.ssh/authorized_keys` executed on every target |
| COC script deleted | `DeleteScript --cli-region=<coc_region> --script_uuid="<uuid>"` exits 0 |
| Local keys deleted | `<temp_dir>/coc_ssh_key` and `.pub` no longer exist |
| Fallback ready | If SSH removal fails, COC cleanup script is created and executed for the failed targets only |

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/verification-method.md (reported line 68)May include surrounding context.

md
| Check | Method |
|--------|--------|
| 60s timer started | Agent announces cleanup countdown and PID |
| Remote key removed (each target) | `sed -i '/coc-temp-key/d' ~<ssh_user>/.ssh/authorized_keys` executed on every target |
| COC script deleted | `DeleteScript --cli-region=<coc_region> --script_uuid="<uuid>"` exits 0 |
| Local keys deleted | `<temp_dir>/coc_ssh_key` and `.pub` no longer exist |
| Fallback ready | If SSH removal fails, COC cleanup script is created and executed for the failed targets only |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
4. **Script Execution** — Execute the script on one or many target ECS instances via COC (batch; each target's region and resource_id are resolved via the COC CLI `ListResources`)
5. **SSH Test** — Verify passwordless SSH connection to every target ECS
6. **Persistent Connection** — Establish SSH ControlMaster so the agent can continue SSH access after keys are cleaned up
7. **Security Cleanup** — After 60 seconds, automatically remove keys from remote `authorized_keys`, delete the local key pair, and clean up the COC script

**Tool chain:** hcloud CLI (KooCLI) + local SSH tools. Deployment is handled through COC script execution only.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow leaves durable modifications in ~/.ssh/config while presenting the process as temporary and automatically cleaned up. Persistent local configuration weakens the claim of ephemeral access and can silently influence later SSH behavior, especially when combined with disabled host-key checks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nHOME_DIR=$(eval echo ~$SSH_USER)\nmkdir -p \"$HOME_DIR/.ssh\" && chmod 700 \"$HOME_DIR/.ssh\"\necho $PUBLIC_KEY >> \"$HOME_DIR/.ssh/authorized_keys\"\nchmod 600 \"$HOME_DIR/.ssh/authorized_keys\"\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
"name": "coc_ssh_key_setup",
    "type": "SHELL",
    "description": "Deploy SSH public key for passwordless login",
    "content": "#!/bin/bash\nset -e\nHOME_DIR=$(eval echo ~$SSH_USER)\nmkdir -p \"$HOME_DIR/.ssh\" && chmod 700 \"$HOME_DIR/.ssh\"\necho $PUBLIC_KEY >> \"$HOME_DIR/.ssh/authorized_keys\"\nchmod 600 \"$HOME_DIR/.ssh/authorized_keys\"\necho KEY_DEPLOYED_SUCCESSFULLY",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill disables SSH host key verification using StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null, which suppresses server authenticity checks. This exposes connections to man-in-the-middle attacks, allowing an attacker on the network path to intercept or impersonate the target host during key deployment, testing, or cleanup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md
ssh <ssh_user>@$eip "echo SSH_MUX_OK"  # verify multiplexing works
done

# 7. Security cleanup (background, survives parent shell exit via nohup + disown)
nohup bash -c '
sleep <cleanup_delay>
# Remove public key from every remote target

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
ssh <ssh_user>@$eip "echo SSH_MUX_OK"  # verify multiplexing works
done

# 7. Security cleanup (background, survives parent shell exit via nohup + disown)
nohup bash -c '
sleep <cleanup_delay>
# Remove public key from every remote target

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md
ssh <ssh_user>@$eip "echo SSH_MUX_OK"  # verify multiplexing works
done

# 7. Security cleanup (background, survives parent shell exit via nohup + disown)
nohup bash -c '
sleep <cleanup_delay>
# Remove public key from every remote target

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

rm -f <temp_dir>/coc_ssh_key <temp_dir>/coc_ssh_key.pub echo "COC SSH keys cleaned up. Existing SSH sessions remain unaffected." ' > <temp_dir>/coc_cleanup.log 2>&1 & disown echo "Cleanup scheduled in <cleanup_delay>s (PID: $!, log: <temp_dir>/coc_cleanup.log)"

text

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md
## Parameters

| Parameter         | Required    | Default      | Constraint                                                                                                                                                                                                                             |
| ----------------- | ----------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ecs_instance_id` | Conditional | None         | Comma-separated list of ECS instance UUIDs. Required if `ecs_ip` is not provided. May be mixed with `ecs_ip` entries — the full set is the batch                                                                                       |
| `ecs_ip`          | Conditional | None         | Comma-separated list of ECS elastic IPv4 addresses. Required if `ecs_instance_id` is not provided. May be mixed with `ecs_instance_id` entries                                                                                         |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

md
| Parameter         | Required    | Default      | Constraint                                                                                                                                                                                                                             |
| ----------------- | ----------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ecs_instance_id` | Conditional | None         | Comma-separated list of ECS instance UUIDs. Required if `ecs_ip` is not provided. May be mixed with `ecs_ip` entries — the full set is the batch                                                                                       |
| `ecs_ip`          | Conditional | None         | Comma-separated list of ECS elastic IPv4 addresses. Required if `ecs_instance_id` is not provided. May be mixed with `ecs_instance_id` entries                                                                                         |
| `ecs_region`      | No          | None         | **Removed from target resolution.** Target ECS regions are discovered via `COC ListResources` (which returns each resource's `region_id` without needing it in advance); this parameter is kept only as an optional hint and is **not required** |
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md
| Parameter         | Required    | Default      | Constraint                                                                                                                                                                                                                             |
| ----------------- | ----------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ecs_instance_id` | Conditional | None         | Comma-separated list of ECS instance UUIDs. Required if `ecs_ip` is not provided. May be mixed with `ecs_ip` entries — the full set is the batch                                                                                       |
| `ecs_ip`          | Conditional | None         | Comma-separated list of ECS elastic IPv4 addresses. Required if `ecs_instance_id` is not provided. May be mixed with `ecs_instance_id` entries                                                                                         |
| `ecs_region`      | No          | None         | **Removed from target resolution.** Target ECS regions are discovered via `COC ListResources` (which returns each resource's `region_id` without needing it in advance); this parameter is kept only as an optional hint and is **not required** |
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
| `ecs_ip`          | Conditional | None         | Comma-separated list of ECS elastic IPv4 addresses. Required if `ecs_instance_id` is not provided. May be mixed with `ecs_instance_id` entries                                                                                         |
| `ecs_region`      | No          | None         | **Removed from target resolution.** Target ECS regions are discovered via `COC ListResources` (which returns each resource's `region_id` without needing it in advance); this parameter is kept only as an optional hint and is **not required** |
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |
| `cleanup_delay`   | No          | `60`         | Seconds to wait before automatic key cleanup (min 10, max 300)                                                                                                                                                                         |
| `persist_timeout`         | No          | `3600`       | Seconds to keep ControlMaster alive after all sessions close (min 60, max 86400)                                                                                                                                                       |
| `server_alive_interval`   | No          | `30`         | Seconds between keepalive packets sent to the remote host to maintain active TCP connection (min 5, max 300)                                                                                                               
...[truncated 24 chars]

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md
| `ecs_region`      | No          | None         | **Removed from target resolution.** Target ECS regions are discovered via `COC ListResources` (which returns each resource's `region_id` without needing it in advance); this parameter is kept only as an optional hint and is **not required** |
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |
| `cleanup_delay`   | No          | `60`         | Seconds to wait before automatic key cleanup (min 10, max 300)                                                                                                                                                                         |
| `persist_timeout`         | No          | `3600`       | Seconds to keep ControlMaster alive after all sessions close (min 60, max 86400)                                                                                                                                                       |
| `server_alive_interval`   | No          | `30`         | Seconds between keepalive packets sent to the remote host to maintain active TCP connection (min 5, max 300)                                                                                                                         |
| `server_alive_count_max`  | No          | `3`          | Number of unanswered keepalive probes before the client disconnects (min 1, max 10)                                                                                                                                  
...[truncated 24 chars]

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md
| `coc_region`      | No          | `cn-north-4` | **COC service region**. COC is a **global-level** service — only `cn-north-4` (China site) and `ap-southeast-3` (International site) are supported. All COC/IAM API calls must target this region; it is independent of the ECS region |
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |
| `cleanup_delay`   | No          | `60`         | Seconds to wait before automatic key cleanup (min 10, max 300)                                                                                                                                                                         |
| `persist_timeout`         | No          | `3600`       | Seconds to keep ControlMaster alive after all sessions close (min 60, max 86400)                                                                                                                                                       |
| `server_alive_interval`   | No          | `30`         | Seconds between keepalive packets sent to the remote host to maintain active TCP connection (min 5, max 300)                                                                                                                         |
| `server_alive_count_max`  | No          | `3`          | Number of unanswered keepalive probes before the client disconnects (min 1, max 10)                                                                                                                                                    |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

md
| `ssh_user`        | No          | `root`       | SSH username on the target ECS. Root or non-root supported; key is deployed to the user's `~/.ssh/authorized_keys`                                                                                                                     |
| `cleanup_delay`   | No          | `60`         | Seconds to wait before automatic key cleanup (min 10, max 300)                                                                                                                                                                         |
| `persist_timeout`         | No          | `3600`       | Seconds to keep ControlMaster alive after all sessions close (min 60, max 86400)                                                                                                                                                       |
| `server_alive_interval`   | No          | `30`         | Seconds between keepalive packets sent to the remote host to maintain active TCP connection (min 5, max 300)                                                                                                                         |
| `server_alive_count_max`  | No          | `3`          | Number of unanswered keepalive probes before the client disconnects (min 1, max 10)                                                                                                                                                    |

## Output Format