Security audit

remote-terminal

Security checks for vulnerabilities and agentic risk

Overview

This remote terminal skill does what it claims, but it handles powerful SSH access and has credential-storage and safety-control gaps that users should review carefully.

Install only if you are comfortable giving the skill authority to run SSH commands on your servers. Prefer SSH keys with an agent, avoid the password options, do not store passwords in hosts.json, review host files before use, and be especially cautious with parallel execution because it can affect many machines at once.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/host_manager.py:31
Finding: Remote SSH passwords are stored and disclosed in plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ssh_exec.py:104
Finding: Unvalidated SSH destinations permit local command execution through option injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/parallel_exec.py:77
Finding: Parallel executor bypasses dangerous-command confirmation controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (68)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description understates sensitive behaviors such as local host-configuration storage, potential credential handling, and use of insecure remote access methods. This mismatch can mislead users and reviewers about the real trust boundary, causing them to invoke a skill that handles secrets or insecure connectivity without informed consent.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
- `rm -rf`, `rm -r`, `del`, `erase` - `shutdown`, `reboot`, `poweroff`, `halt` - `mkfs`, `fdisk`, `parted`, `dd` - `chmod 777`, `chown -R` - `> /dev/`, `truncate` - `kill -9`, `pkill`, `killall` - `iptables`, `ufw`, `firewall-cmd`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
- `DROP DATABASE`, `DELETE FROM`, `TRUNCATE` **Confirmation format:** > ⚠️ **Dangerous command detected**: `rm -rf /var/log/*` > This will permanently delete files. Proceed? (yes/no) ### Command Blacklist

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
- `DROP DATABASE`, `DELETE FROM`, `TRUNCATE` **Confirmation format:** > ⚠️ **Dangerous command detected**: `rm -rf /var/log/*` > This will permanently delete files. Proceed? (yes/no) ### Command Blacklist

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
- `DROP DATABASE`, `DELETE FROM`, `TRUNCATE` **Confirmation format:** > ⚠️ **Dangerous command detected**: `rm -rf /var/log/*` > This will permanently delete files. Proceed? (yes/no) ### Command Blacklist

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Listing rm -rf / as overrideable indicates the safety model permits execution of irreversible system-destruction commands after a conversational exception. In a skill designed for remote shell access, that creates a severe risk of accidental or manipulated destructive execution on important hosts.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
### Command Blacklist These commands are blocked by default and require explicit user override: - `rm -rf /` (entire filesystem) - `mkfs` on mounted drives - `dd` to primary disk - Any command piping to `/dev/sda` or similar

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Listing rm -rf / as overrideable indicates the safety model permits execution of irreversible system-destruction commands after a conversational exception. In a skill designed for remote shell access, that creates a severe risk of accidental or manipulated destructive execution on important hosts.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
### Command Blacklist These commands are blocked by default and require explicit user override: - `rm -rf /` (entire filesystem) - `mkfs` on mounted drives - `dd` to primary disk - Any command piping to `/dev/sda` or similar

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill proposes storing host information, including authentication method and key path, in a local memory file. In this context, centralized local storage of connection metadata increases the attack surface for credential discovery and may encourage future addition of plaintext secrets despite the description not adequately warning about that risk.
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
"host": "192.168.1.100", "user": "admin", "method": "ssh-key", "key": "~/.ssh/id_rsa", "tags": ["web", "critical"] }, "staging": {

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 23)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 27)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 28)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 39)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 42)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ssh_config_guide.md (reported line 60)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ssh_config_guide.md (reported line 115)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ssh_config_guide.md (reported line 241)May include surrounding context.
bash
# Strong passphrase (use a password manager) ssh-keygen -p -f ~/.ssh/id_ed25519 # Correct permissions chmod 700 ~/.ssh

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 41)May include surrounding context.
Add key

ssh-add ~/.ssh/id_ed25519

macOS: store in keychain

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 42)May include surrounding context.
Add key

ssh-add ~/.ssh/id_ed25519

macOS: store in keychain

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

text

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security_best_practices.md (reported line 115)May include surrounding context.
bash
# Check known hosts cat ~/.ssh/known_hosts # Remove old/compromised key ssh-keygen -R hostname

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ssh_config_guide.md (reported line 240)May include surrounding context.
md
# Global defaults Host * AddKeysToAgent yes UseKeychain yes IdentityFile ~/.ssh/id_ed25519 ServerAliveInterval 60 ServerAliveCountMax 3

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
Examples: ssh_exec.py production "uptime" ssh_exec.py 192.168.1.100 "docker ps" --user admin --key ~/.ssh/id_rsa ssh_exec.py staging "systemctl status nginx" --log """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
Examples: ssh_exec.py production "uptime" ssh_exec.py 192.168.1.100 "docker ps" --user admin --key ~/.ssh/id_rsa ssh_exec.py staging "systemctl status nginx" --log """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
Examples: ssh_exec.py production "uptime" ssh_exec.py 192.168.1.100 "docker ps" --user admin --key ~/.ssh/id_rsa ssh_exec.py staging "systemctl status nginx" --log """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
md
Examples: ssh_exec.py production "uptime" ssh_exec.py 192.168.1.100 "docker ps" --user admin --key ~/.ssh/id_rsa ssh_exec.py staging "systemctl status nginx" --log """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
Examples: ssh_exec.py production "uptime" ssh_exec.py 192.168.1.100 "docker ps" --user admin --key ~/.ssh/id_rsa ssh_exec.py staging "systemctl status nginx" --log """

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Add key

macOS: store in keychain

Credential Access

Add key

macOS: store in keychain

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis