Hostinger VPS MCP Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:00 AM UTC
• Version: 1.0.0

Overview

This is a coherent VPS deployment skill, but it uses unsafe root-level deployment defaults that could expose or compromise a server.

Review and harden the scripts before running them on a real VPS. Pin and verify installers, validate all ports/names/domains/keys, keep SSH host-key checking enabled, avoid public XRDP/webchat exposure by default, remove passwordless full sudo and Docker access from the runtime account, avoid root SSH key login, and treat any saved Hostinger or integration token as sensitive infrastructure access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (14)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/03-install-docker.sh:12

Finding

Docker Installer Executes Mutable Remote Code as Root

Content

View full analysis

/dev/null || true # Install Docker using official script echo "[2/4] Installing Docker..." curl -fsSL https://get.docker.com | sh ``` ### Technical Analysis The script is intended to run as root and pipes an HTTP response directly into `sh`. The retrieved payload is not pinned to a reviewed version and is not authenticated using a separately verified signature or checksum. Although `get.docker.com` is Docker's official convenience endpoint, the effective code can change after this Skill has been reviewed. Compromise of the upstream service, DNS resolution, TLS trust chain, or delivery infrastructure would permit arbitrary root-level payload substitution. ### Attack Path 1. An administrator invokes `03-install-docker.sh` as root. 2. The script requests the current contents of `https://get.docker.com`. 3. An upstream or network trust compromise supplies modified shell code. 4. The response is sent directly to `sh` without inspection or verification. 5. The substituted payload executes with unrestricted root privileges. ### Impact Assessment Successful exploitation provides complete control of the VPS, including the ability to read credentials, alter SSH configuration, access agent data, install persistent services, modify containers, and compromise all users. ]]>

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/security/setup-tailscale.sh:13

Finding

Tailscale Installer Executes Mutable Remote Code as Root

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy-all.sh:29

Finding

Deployment Arguments Are Interpolated into a Root Remote Shell Command

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/deploy-all.sh:23

Finding

SSH Host Authentication Is Explicitly Disabled During Root Deployment

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/01-server-setup.sh:39

Finding

Koda Account Receives Unrestricted Passwordless Root Access

Content

View full analysis

/dev/null; then useradd -m -s /bin/bash -G sudo koda # Generate random password KODA_PASS=$(openssl rand -base64 12) echo "koda:$KODA_PASS" | chpasswd echo "" echo "⚠️ Generated password for 'koda' user: $KODA_PASS" echo "⚠️ Save this! Change with: passwd koda" echo "" fi # Allow koda user to sudo without password (for automation) echo "koda ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/koda ``` ### Technical Analysis The account used for the GUI, agent workspace, and routine administration is placed in the `sudo` group and granted `NOPASSWD:ALL`. This makes any code execution as `koda` equivalent to immediate root compromise. Unrestricted sudo is not minimally necessary to run the agent, access its workspace, or use XRDP. It defeats isolation between the externally accessible application account and the host operating system. ### Attack Path 1. An attacker compromises the `koda` account through XRDP credentials, an agent vulnerability, or local code execution. 2. The attacker runs any command using `sudo`. 3. Sudo performs no password or command restriction check. 4. The attacker obtains an unrestricted root shell. ### Impact Assessment The attacker gains complete control of the VPS and all stored secrets, containers, SSH configuration, firewall rules, users, and agent data. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/03-install-docker.sh:22

Finding

Docker Group Membership Grants the Agent Account Root-Equivalent Control

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/01-server-setup.sh:63

Finding

Privileged Services Are Publicly Exposed by Default

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/04-deploy-koda.sh:45

Finding

OpenClaw Container Build Uses Mutable and Unpinned Sources

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/security/setup-cloudflare-tunnel.sh:13

Finding

Cloudflared Is Downloaded from an Unverified Mutable Latest Release

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security/lockdown-public.sh:22

Finding

Shell-Sourceable Root Configuration Contains Unvalidated Deployment Input

Content

View full analysis

/dev/null || true # Get all custom Koda ports from config if [ -f /etc/koda/config ]; then source /etc/koda/config if [ -n "$KODA_PORT" ] && [ "$KODA_PORT" != "18789" ]; then ufw delete allow ${KODA_PORT}/tcp 2>/dev/null || true fi fi ``` The sourced file is created from unvalidated arguments in `scripts/01-server-setup.sh:95-97`: ```sh mkdir -p /etc/koda echo "KODA_PORT=$KODA_PORT" > /etc/koda/config echo "SSH_PORT=$SSH_PORT" >> /etc/koda/config ``` ### Technical Analysis `source` treats the data file as executable shell code. Since port arguments are not validated before being written, crafted shell syntax can be persisted in `/etc/koda/config`. Running the lockdown script later evaluates that syntax as root. Even if the current deployment interface normally supplies numeric ports, the script itself does not enforce this security boundary. ### Attack Path 1. An attacker or unsafe automation supplies a crafted Koda or SSH port value. 2. `01-server-setup.sh` writes the value verbatim into `/etc/koda/config`. 3. An administrator later runs `lockdown-public.sh` as root. 4. The script sources `/etc/koda/config`. 5. Embedded shell syntax executes with root privileges. ### Impact Assessment Successful exploitation provides arbitrary root command execution and can remain dormant in the configuration until the lockdown operation is invoked. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security/setup-wireguard.sh:7

Finding

WireGuard Client Name Permits Root Path and Configuration Injection

Content

View full analysis

server_public.key wg genkey | tee ${CLIENT_NAME}_private.key | wg pubkey > ${CLIENT_NAME}_public.key SERVER_PRIVATE=$(cat server_private.key) SERVER_PUBLIC=$(cat server_public.key) CLIENT_PRIVATE=$(cat ${CLIENT_NAME}_private.key) CLIENT_PUBLIC=$(cat ${CLIENT_NAME}_public.key) ``` The same value is later used in another root-owned path: ```sh cat > /etc/wireguard/${CLIENT_NAME}.conf << EOF ``` ### Technical Analysis `CLIENT_NAME` is used unquoted and without validation in filenames under `/etc/wireguard`. Whitespace, glob characters, option-like content, or traversal components can change command parsing or target unintended paths. It is also inserted into generated configuration comments. The restrictive `umask 077` appropriately protects generated key material, but it does not prevent path manipulation. ### Attack Path 1. An attacker controls or influences `CLIENT_NAME`. 2. The supplied name contains path separators, shell word-splitting characters, or wildcard syntax. 3. Root-run `tee`, redirection, or `cat` operations resolve unintended arguments or paths. 4. Files outside the expected client namespace may be created or overwritten. 5. WireGuard subsequently consumes attacker-influenced configuration. ### Impact Assessment Depending on the supplied value and filesystem state, exploitation may overwrite root-controlled files, corrupt VPN configuration, disclose generated material, or disrupt networking. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security/setup-https.sh:7

Finding

Unvalidated HTTPS Inputs Are Embedded in Root-Owned Nginx Configuration

Content

View full analysis

/etc/nginx/sites-available/koda << EOF server { listen 80; server_name $DOMAIN; location / { proxy_pass http://127.0.0.1:$KODA_PORT; proxy_http_version 1.1; proxy_set_header Upgrade \$http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme; proxy_read_timeout 86400; } } EOF ``` ### Technical Analysis The domain and port are copied directly into an Nginx configuration generated as root. A value containing Nginx delimiters may introduce additional directives or alter proxy behavior. The port is also not constrained to a valid numeric TCP port. `nginx -t` checks syntax, but it does not determine whether syntactically valid injected directives are authorized. ### Attack Path 1. An attacker influences `DOMAIN` or `KODA_PORT`. 2. The value contains valid Nginx syntax that terminates or extends the intended directive. 3. The script writes the resulting configuration as root. 4. `nginx -t` accepts the syntactically valid injected configuration. 5. Nginx reloads with attacker-influenced routing or content behavior. ### Impact Assessment Exploitation can redirect traffic, expose unintended local services, alter virtual-host handling, or cause denial of service. The exact impact depends on the injected Nginx directives and installed modules. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/security/setup-ssh-keys.sh:8

Finding

Unvalidated Public Key Is Granted Direct Root SSH Access

Content

View full analysis

> /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys # Add key to koda user mkdir -p /home/koda/.ssh chmod 700 /home/koda/.ssh echo "$PUBLIC_KEY" >> /home/koda/.ssh/authorized_keys chmod 600 /home/koda/.ssh/authorized_keys chown -R koda:koda /home/koda/.ssh # Disable password authentication echo "[*] Disabling password authentication..." sed -i 's/^#*PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/^#*ChallengeResponseAuthentication .*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config sed -i 's/^#*UsePAM .*/UsePAM no/' /etc/ssh/sshd_config sed -i 's/^#*PermitRootLogin .*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config # Restart SSH systemctl restart sshd ``` ### Technical Analysis The script grants the supplied key access to both `root` and `koda` without validating the key format or confirming its fingerprint. It then disables password authentication and restarts SSH before proving that the intended administrator can authenticate. The SSH key operations are related to the declared hardening feature, but direct root authorization exceeds the minimum privileges needed. ### Attack Path 1. An attacker substitutes their public key in the script invocation or deployment input. 2. The script appends it to `/root/.ssh/authorized_keys`. 3. Root key login remains permitted through `PermitRootLogin prohibit-password`. 4. The attacker authenticates directly as root. 5. Alternatively, malformed or incorrect key input combined with disabled password authentication locks out the legitimate administrator. ### Impact Assessment A substi ...[truncated 129 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-mcp-integrations.sh:21

Finding

Pipedream Bearer Token Is Persisted Without Explicit File Permission Hardening

Content

View full analysis

"$MCP_CONFIG" << 'EOF' { "servers": {} } EOF ``` ```sh # Add Pipedream if provided if [ -n "$PIPEDREAM_KEY" ]; then echo "[3/3] Configuring Pipedream MCP..." mcporter config add pipedream \ --url "https://api.pipedream.com/v1/connect/mcp" \ --header "Authorization: Bearer $PIPEDREAM_KEY" \ --config "$MCP_CONFIG" echo " ✓ Pipedream connected" else echo "[3/3] Skipping Pipedream (no API key provided)" fi ``` ### Technical Analysis The bearer token is passed to `mcporter` for persistence in the MCP configuration. The script does not establish `umask 077`, explicitly apply mode `0600`, or use a secret-reference mechanism. The actual readability depends on the invoking process's umask and `mcporter` behavior, but the script does not enforce a safe permission boundary. ### Attack Path 1. The script is run under a permissive umask. 2. `mcporter` stores the authorization header in `mcporter.json`. 3. Another local account reads the configuration file. 4. The account extracts the Pipedream bearer token. 5. The token is reused against the configured integration endpoint. ### Impact Assessment Exposure may grant access to the Pipedream resources and external actions authorized by the token. Scope depends on the token's server-side permissions. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (103)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to automate VPS provisioning and deployment, but the content shown is largely documentation and command examples rather than self-contained, bounded automation. This mismatch can cause an agent or user to trust the skill with high-impact actions without clear disclosure of what it actually modifies locally versus remotely, including credential storage and config changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill documents persistent storage of a high-value Hostinger API token in a local secrets file and indicates use via environment variables. Any process, misconfiguration, backup leak, or local compromise affecting that file can lead to unauthorized VPS management actions, including provisioning, starting, stopping, and password resets.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

- **Auth**: Bearer token via `API_TOKEN` env var
- **Transport**: stdio (default) or HTTP streaming

**Important:** The API token is stored in `~/.openclaw/secrets.json` (the vault), **not** in plaintext in mcporter config. A `SecretRef` points to the vault key `HOSTINGER_API_TOKEN`.

### Key API Endpoints

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

This repeats the documented persistence of the Hostinger API token in a local file. Because the token grants control over hosted infrastructure, local secret compromise can translate directly into account misuse and destructive cloud actions.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

### Vault Storage

The Hostinger API token is stored in **`~/.openclaw/secrets.json`** under the key `HOSTINGER_API_TOKEN`. It is **never stored in plaintext** in mcporter.json — only a `SecretRef` pointer is stored there.

### Post-Deployment Hardening

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The troubleshooting guidance tells the operator to check the secrets file directly and demonstrates passing the API token on the command line through an environment assignment. Both patterns increase the risk of credential disclosure through shell history, process inspection, screen sharing, logs, or copied terminal transcripts.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

- Consider headless mode if GUI not needed

**MCP tools not loading?**
- Verify token is saved: check `~/.openclaw/secrets.json` for `HOSTINGER_API_TOKEN`
- Run: `API_TOKEN=your-token mcporter list hostinger-api`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/hostinger-backend.ts (reported line 12)May include surrounding context.

ts

const HOSTINGER_SERVER_NAME = "hostinger-api";
const HOSTINGER_CONFIG_PATH = path.join(os.homedir(), ".openclaw", "workspace", "config", "hostinger.json");
const VAULT_PATH = path.join(os.homedir(), ".openclaw", "secrets.json");
const VAULT_KEY = "HOSTINGER_API_TOKEN";

function readVault(): Record<string, string> {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The code persists the Hostinger API token in a plaintext JSON secrets file under the user's home directory. Even with mode 0600, plaintext at-rest storage increases exposure to local compromise, backups, sync tools, malware, and accidental disclosure; this is especially sensitive because the skill is for VPS administration and the token likely grants infrastructure access.

Content

Scanner excerpt · references/hostinger-backend.ts (reported line 146)May include surrounding context.

ts

if (!config) config = { mcpServers: {}, imports: [] };
      if (!config.mcpServers) config.mcpServers = {};

      // Store token in vault (secrets.json) — not plaintext in mcporter
      writeVaultToken(apiToken);

      // mcporter entry uses a SecretRef so the plaintext isn't duplicated

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The configured view renders the Hostinger API token directly inside a code element, exposing a sensitive credential in plaintext to anyone with UI access, screen-sharing visibility, logs, screenshots, or browser inspection. In this skill context, that token may grant control over VPS, billing, and other Hostinger account resources, making exposure especially dangerous.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Displaying the configured API token in normal UI text is a direct secret-exposure issue. Because this skill is for Hostinger VPS deployment and management, compromise of the token could enable unauthorized infrastructure changes, password resets, instance lifecycle actions, and possibly broader account operations depending on token scope.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Using 'curl ... | sh' removes any inspection boundary between untrusted network content and root command execution. In a provisioning script for internet-connected VPS hosts, this is especially dangerous because compromise of the fetched content immediately becomes full-system compromise.

Content

Scanner excerpt · scripts/03-install-docker.sh (reported line 16)May include surrounding context.

sh

# Install Docker using official script
echo "[2/4] Installing Docker..."
curl -fsSL https://get.docker.com | sh

# Install Docker Compose plugin
echo "[3/4] Installing Docker Compose..."

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/security/setup-cloudflare-tunnel.sh (reported line 17)May include surrounding context.

sh

echo "[1/3] Installing cloudflared..."
curl -fsSL https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o /tmp/cloudflared.deb
dpkg -i /tmp/cloudflared.deb
rm /tmp/cloudflared.deb

# Install as service with token
echo "[2/3] Configuring tunnel..."

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/security/setup-https.sh (reported line 45)May include surrounding context.

sh

EOF

ln -sf /etc/nginx/sites-available/koda /etc/nginx/sites-enabled/
rm -f /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx

# Open port 80 and 443

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Appending an arbitrary caller-supplied key to /root/.ssh/authorized_keys grants persistent remote login to the root account. In a deployment skill this is especially dangerous because any mistaken, spoofed, or attacker-provided key becomes full administrative access and may be hard to notice later.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 16)May include surrounding context.

sh

# Add key to root
mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "$PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Add key to koda user

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 90% confidence

Finding

The YARA hit is triggered because the script injects a provided SSH key into both root and user authorized_keys, which is a known persistence technique used by attackers. In this administrative context the likely intent is benign setup, but the combination of root key installation and password-login disablement makes operator mistakes or supply-chain abuse particularly impactful.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 16)May include surrounding context.

sh

#!/bin/bash
# Configure SSH Key-Only Authentication
# Usage: ./setup-ssh-keys.sh "ssh-rsa AAAA... user@host"
# Run as root

set -e

PUBLIC_KEY="${1:?Usage: $0 \"ssh-rsa AAAA... user@host\"}"

echo "🔐 Setting up SSH Key Authentication"
echo "====================================="

# Add key to root
mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "$PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Add key to koda user
mkdir -p /home/koda/.ssh
chmod 700 /home/koda/.ssh
echo "$PUBLIC_KEY" >> /home/koda/.ssh/authorized_keys
chmod 600 /home/koda/.ssh/authorized_keys
chown -R koda:koda /home/koda/.ssh

# Disable password authentication
echo "[*] Disabling password authentication..."
sed -i 's/^#*PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#*ChallengeResponseAuthentication .*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#*UsePAM .*/UsePAM n

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 17)May include surrounding context.

sh

mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "$PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Add key to koda user
mkdir -p /home/koda/.ssh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 23)May include surrounding context.

sh

mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "$PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Add key to koda user
mkdir -p /home/koda/.ssh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Appending a supplied key to /home/koda/.ssh/authorized_keys creates persistent access for that account. In context this is an intended setup action, but it is still security-sensitive because an untrusted or incorrect key would silently authorize future remote access.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 22)May include surrounding context.

sh

# Add key to koda user
mkdir -p /home/koda/.ssh
chmod 700 /home/koda/.ssh
echo "$PUBLIC_KEY" >> /home/koda/.ssh/authorized_keys
chmod 600 /home/koda/.ssh/authorized_keys
chown -R koda:koda /home/koda/.ssh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Appending a supplied key to /home/koda/.ssh/authorized_keys creates persistent access for that account. In context this is an intended setup action, but it is still security-sensitive because an untrusted or incorrect key would silently authorize future remote access.

Content

Scanner excerpt · scripts/security/setup-ssh-keys.sh (reported line 22)May include surrounding context.

sh

# Add key to koda user
mkdir -p /home/koda/.ssh
chmod 700 /home/koda/.ssh
echo "$PUBLIC_KEY" >> /home/koda/.ssh/authorized_keys
chmod 600 /home/koda/.ssh/authorized_keys
chown -R koda:koda /home/koda/.ssh