huawei-cloud-ecs-passwordless-login

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Downloads the official KooCLI (hcloud) binary from Huawei Cloud's Object Storage Service at hwcloudcli.obs.cn-north-1.myhuaweicloud.com.
  • [COMMAND_EXECUTION]: Modifies the local user's SSH configuration file (~/.ssh/config) to implement ControlMaster multiplexing, ensuring persistent access for the agent after the initial key removal.
  • [COMMAND_EXECUTION]: Utilizes background process management (nohup and disown) to schedule a delayed cleanup task that deletes local keys and remote authorization entries after 60 seconds.
  • [COMMAND_EXECUTION]: Executes shell commands on remote ECS instances through the Huawei Cloud COC ExecuteScript API to manage /root/.ssh/authorized_keys.
  • [COMMAND_EXECUTION]: Automates account-level IAM changes by creating the ServiceAgencyForCOC agency and binding administrative roles to enable COC cross-service operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 03:54 AM
Security Audit — agent-trust-hub — huawei-cloud-ecs-passwordless-login