1. You shouldn't need to start sshd service on either of the stemcells. We need to enforce that. What services are you accessing via ssh that it needs to be open? 
2. Someone might start an unprotected ftp service or any number of unknows service. String interpolation for shell execution is a clear risk vector.