huawei-cloud-ecs-passwordless-login
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the official KooCLI (hcloud) binary from Huawei Cloud's Object Storage Service at
hwcloudcli.obs.cn-north-1.myhuaweicloud.com. - [COMMAND_EXECUTION]: Modifies the local user's SSH configuration file (
~/.ssh/config) to implement ControlMaster multiplexing, ensuring persistent access for the agent after the initial key removal. - [COMMAND_EXECUTION]: Utilizes background process management (
nohupanddisown) to schedule a delayed cleanup task that deletes local keys and remote authorization entries after 60 seconds. - [COMMAND_EXECUTION]: Executes shell commands on remote ECS instances through the Huawei Cloud COC
ExecuteScriptAPI to manage/root/.ssh/authorized_keys. - [COMMAND_EXECUTION]: Automates account-level IAM changes by creating the
ServiceAgencyForCOCagency and binding administrative roles to enable COC cross-service operations.
Audit Metadata