huawei-cloud-ecs-passwordless-login

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The workflow intentionally provisions SSH access via a COC script, creates an agency with broad privileges, and then hides evidence by removing deployed keys while keeping a ControlMaster multiplexed session (and a reusable parameterized script) that grants persistent, stealthy remote access—behavior consistent with a backdoor/persistence mechanism and potential abuse of remote-execution capabilities.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). Flagged because the skill explicitly instructs creating IAM agencies and binding roles, generating and deploying SSH keys into /root/.ssh/authorized_keys, modifying local ~/.ssh/config, and starting persistent ControlMaster sessions — all actions that change system state and grant/preserve privileged access.