ClawHub
Back to skill

Security audit

Raspberry Pi SSH Doctor / 树莓派SSH诊断助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Raspberry Pi SSH diagnostic helper, with nontrivial but disclosed and approval-gated JishuBuddy installation and device-session behavior.

Before installing, review the displayed npm package version, registry, and global prefix. Only approve the install if you trust JishuBuddy and are comfortable with a global npm package and its disclosed telemetry; set JISHUBUDDY_TELEMETRY_DISABLED=true before launch if you do not want that telemetry. Do not provide private keys, passwords, passphrases, or unsanitized SSH output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill’s declared purpose is SSH diagnosis, but it also directs inspection of the local environment, npm registry queries, and optional global installation/version management of JishuBuddy. Even though the flow asks for explicit approval before installation, this is still a real capability expansion beyond diagnosis, which can surprise users, increase attack surface, and lead to unintended system changes or supply-chain exposure if an operator follows the instructions uncritically.

Ae1

High
Category
analysis-evasion
Content
`<skill-directory>` to the absolute directory containing this `SKILL.md`,
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
> trust, authentication, or remote shell. Only after a trusted,
   > authenticated connection succeeds, verify Linux and non-interactive
   > Bash with read-only commands. Do not replace host keys, edit SSH
   > configuration, install keys, or restart services without approval.

Report the observed error, supported explanation, and smallest next step.
Mark later stages `unconfirmed` or `blocked` until actual evidence is
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.