ClawHub
Back to skill

Security audit

Deepspeed Finetune

Security checks for vulnerabilities and agentic risk

Overview

This DeepSpeed fine-tuning skill is mostly coherent, but its remote SSH helper creates lasting passwordless access and uses unsafe SSH practices that require careful review.

Install only if you trust the publisher and are comfortable granting the skill remote SSH control. Use a dedicated unprivileged remote account, avoid password-based SSH where possible, verify host keys out of band, do not enable trust_remote_code for unreviewed models, and remove any generated key from both the local machine and remote authorized_keys when finished.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
scripts/remote_train.py:480
Finding

Persistent Passwordless SSH Access Installed on Remote Systems

Content
View full analysis
/dev/null || " f"(echo '{pub_key_b64}' >> ~/.ssh/.deepspeed_setup_marker && " f"echo '{pub_key_b64}' | base64 -d >> ~/.ssh/authorized_keys)" ) ``` ### Technical Analysis The `setup-keys` workflow generates an SSH private key with an empty passphrase and appends its public key to the remote account's `~/.ssh/authorized_keys`. This creates an authorization mechanism that remains valid after the training process and SSH ControlMaster session have ended. The operation is related to remote training, but it exceeds the minimum access duration required to launch or monitor an individual training job. The `s ...[truncated 1434 chars]
Remediation
View remediation
"` - `command=""` - `no-agent-forwarding` - `no-port-forwarding` - `no-X11-forwarding` - `no-pty` 7. Prefer an existing user-managed SSH agent or credential rather than creating a new persistent identity. 8. Add a dedicated cleanup command that reliably removes both the public key and `.deepspeed_setup_marker`. 9. Avoid using a privileged remote account when a dedicated, restricted training account is sufficient. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/remote_train.py:105
Finding

SSH Host Authenticity Verification Is Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/remote_train.py:259
Finding

Remote Command Injection Through Incorrect POSIX Shell Escaping

Content
View full analysis
{safe_log} 2>&1\"" ) print(f"Launching training on {host}...") stdout, stderr, code = _ssh_exec(host, port, remote_cmd, timeout=30) ``` ### Technical Analysis `subprocess.list2cmdline` implements quoting rules for Windows command-line parsing. It is not a POSIX shell-escaping function. The generated values are subsequently interpolated into a command evaluated by the remote Unix shell. Inputs such as `--remote-dir`, `--remote-python`, and `--log` can therefore retain shell metacharacters or command substitutions. The nested double-quoted `tmux` command increases the parsing complexity and makes correct escaping more difficult. For example, a crafted value containing command substitution may be evaluated by the remote shell when `remote_cmd` is executed. This is especially significant because the CLI allows the caller to control all affected arguments. ### Attack Path 1. An attacker obtains influence over launch arguments, an automated job definition, or an Agent instruction that supplies remote-training parameters. 2. The attacker inserts POSIX shell syntax into `--remote-dir`, `--remote-python`, or `--log`. 3. `_shell_safe` applies Windows quoting rather than POSIX escaping. 4. The cra ...[truncated 653 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/remote_train.py:135
Finding

SSH Password Copied into Child Process Command-Line Arguments

Content
View full analysis
`. 3. The child process remains active while connecting or performing a remote operation. 4. A local user or monitoring component with sufficient process-inspection access reads the argument vector. 5. The observer recovers the remote SSH password and may reuse it against the target server. ### Impact Assessment Exposure compromises the remote account password. The privileges o ...[truncated 262 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/ds_train.py:188
Finding

Optional Execution of Code Supplied by Remote Model Repositories

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (46)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

If the skill in fact supports arbitrary remote SSH command execution, credential setup, file transfer, tmux/session management, and password-based fallback while presenting itself mainly as a fine-tuning skill, that is a significant security concern. Concealed or under-declared remote orchestration expands attack surface, can enable lateral movement or data exfiltration on remote hosts, and makes users more likely to authorize risky behavior without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

If the skill in fact supports arbitrary remote SSH command execution, credential setup, file transfer, tmux/session management, and password-based fallback while presenting itself mainly as a fine-tuning skill, that is a significant security concern. Concealed or under-declared remote orchestration expands attack surface, can enable lateral movement or data exfiltration on remote hosts, and makes users more likely to authorize risky behavior without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill in fact supports arbitrary remote SSH command execution, credential setup, file transfer, tmux/session management, and password-based fallback while presenting itself mainly as a fine-tuning skill, that is a significant security concern. Concealed or under-declared remote orchestration expands attack surface, can enable lateral movement or data exfiltration on remote hosts, and makes users more likely to authorize risky behavior without informed consent.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remote_training.md (reported line 180)May include surrounding context.

md
## Security Notes

- **Host Key Verification**: SSH connections use `StrictHostKeyChecking=no`, which skips host key verification. This is necessary for automated password-based connections (sshpass doesn't support interactive host key prompts), but exposes the connection to potential man-in-the-middle attacks. **Mitigation**: After initial setup, configure SSH key authentication and run `ssh-keyscan <host> >> ~/.ssh/known_hosts` to permanently trust the host key. Subsequent connections via ControlMaster will use the saved host key.
- **Passwords**: Passed to child processes via environment variables only, never written to any file
- **Session file**: `.remote_train_session.json` only stores non-sensitive info (host, port, pid, log path, etc.)
- **SSH ControlMaster socket**: Stored in system temp directory. Recommend periodic cleanup: `rm -rf /tmp/deepspeed_remote_ssh/`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/remote_training.md (reported line 183)May include surrounding context.

md
- **Host Key Verification**: SSH connections use `StrictHostKeyChecking=no`, which skips host key verification. This is necessary for automated password-based connections (sshpass doesn't support interactive host key prompts), but exposes the connection to potential man-in-the-middle attacks. **Mitigation**: After initial setup, configure SSH key authentication and run `ssh-keyscan <host> >> ~/.ssh/known_hosts` to permanently trust the host key. Subsequent connections via ControlMaster will use the saved host key.
- **Passwords**: Passed to child processes via environment variables only, never written to any file
- **Session file**: `.remote_train_session.json` only stores non-sensitive info (host, port, pid, log path, etc.)
- **SSH ControlMaster socket**: Stored in system temp directory. Recommend periodic cleanup: `rm -rf /tmp/deepspeed_remote_ssh/`

## Session Management

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/remote_training.md (reported line 183)May include surrounding context.

md
- **Host Key Verification**: SSH connections use `StrictHostKeyChecking=no`, which skips host key verification. This is necessary for automated password-based connections (sshpass doesn't support interactive host key prompts), but exposes the connection to potential man-in-the-middle attacks. **Mitigation**: After initial setup, configure SSH key authentication and run `ssh-keyscan <host> >> ~/.ssh/known_hosts` to permanently trust the host key. Subsequent connections via ControlMaster will use the saved host key.
- **Passwords**: Passed to child processes via environment variables only, never written to any file
- **Session file**: `.remote_train_session.json` only stores non-sensitive info (host, port, pid, log path, etc.)
- **SSH ControlMaster socket**: Stored in system temp directory. Recommend periodic cleanup: `rm -rf /tmp/deepspeed_remote_ssh/`

## Session Management

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/remote_training.md (reported line 183)May include surrounding context.

md
- **Host Key Verification**: SSH connections use `StrictHostKeyChecking=no`, which skips host key verification. This is necessary for automated password-based connections (sshpass doesn't support interactive host key prompts), but exposes the connection to potential man-in-the-middle attacks. **Mitigation**: After initial setup, configure SSH key authentication and run `ssh-keyscan <host> >> ~/.ssh/known_hosts` to permanently trust the host key. Subsequent connections via ControlMaster will use the saved host key.
- **Passwords**: Passed to child processes via environment variables only, never written to any file
- **Session file**: `.remote_train_session.json` only stores non-sensitive info (host, port, pid, log path, etc.)
- **SSH ControlMaster socket**: Stored in system temp directory. Recommend periodic cleanup: `rm -rf /tmp/deepspeed_remote_ssh/`

## Session Management

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 129)May include surrounding context.

md
2. **Specify dtype:** `--torch_dtype bfloat16`
3. **Trust remote code:** `--trust_remote_code true`
4. **Upgrade transformers:** `pip install --upgrade transformers`
5. **Clear cache:** `rm -rf ~/.cache/huggingface/`

### Issue 12: LoRA Adapter Issues

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 129)May include surrounding context.

md
2. **Specify dtype:** `--torch_dtype bfloat16`
3. **Trust remote code:** `--trust_remote_code true`
4. **Upgrade transformers:** `pip install --upgrade transformers`
5. **Clear cache:** `rm -rf ~/.cache/huggingface/`

### Issue 12: LoRA Adapter Issues

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 129)May include surrounding context.

md
2. **Specify dtype:** `--torch_dtype bfloat16`
3. **Trust remote code:** `--trust_remote_code true`
4. **Upgrade transformers:** `pip install --upgrade transformers`
5. **Clear cache:** `rm -rf ~/.cache/huggingface/`

### Issue 12: LoRA Adapter Issues

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The remote-exec feature provides unrestricted arbitrary command execution on the remote host, which goes well beyond model fine-tuning and effectively turns the skill into a generic remote shell wrapper. In this context, any caller with access to the skill can run destructive commands, access sensitive data, or establish persistence on managed GPU servers.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The code programmatically creates and modifies ~/.ssh/authorized_keys on the remote system, altering login credentials and establishing future access. In a training skill, this is highly sensitive because it can enable persistent administrative entry to remote servers beyond the immediate task.

Content

Scanner excerpt · scripts/remote_train.py (reported line 516)May include surrounding context.

python
remote_setup = (
        f"mkdir -p ~/.ssh && "
        f"chmod 700 ~/.ssh && "
        f"touch ~/.ssh/authorized_keys && "
        f"chmod 600 ~/.ssh/authorized_keys && "
        f"grep -qF '{pub_key_b64}' ~/.ssh/.deepspeed_setup_marker 2>/dev/null || "
        f"(echo '{pub_key_b64}' >> ~/.ssh/.deepspeed_setup_marker && "

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This line participates in setting up and securing the authorized_keys file that will be used to grant SSH access, which is credential-management behavior outside the expected scope of fine-tuning orchestration. Unauthorized or poorly governed use could create durable access paths to remote infrastructure.

Content

Scanner excerpt · scripts/remote_train.py (reported line 517)May include surrounding context.

python
f"mkdir -p ~/.ssh && "
        f"chmod 700 ~/.ssh && "
        f"touch ~/.ssh/authorized_keys && "
        f"chmod 600 ~/.ssh/authorized_keys && "
        f"grep -qF '{pub_key_b64}' ~/.ssh/.deepspeed_setup_marker 2>/dev/null || "
        f"(echo '{pub_key_b64}' >> ~/.ssh/.deepspeed_setup_marker && "
        f"echo '{pub_key_b64}' | base64 -d >> ~/.ssh/authorized_keys)"

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

Appending a decoded public key into ~/.ssh/authorized_keys grants future SSH access to the remote account and can function as persistence if misused. Because the skill is advertised for model training, embedding remote access establishment materially increases danger and could be abused to retain access to GPU servers after the original task.

Content

Scanner excerpt · scripts/remote_train.py (reported line 520)May include surrounding context.

python
f"chmod 600 ~/.ssh/authorized_keys && "
        f"grep -qF '{pub_key_b64}' ~/.ssh/.deepspeed_setup_marker 2>/dev/null || "
        f"(echo '{pub_key_b64}' >> ~/.ssh/.deepspeed_setup_marker && "
        f"echo '{pub_key_b64}' | base64 -d >> ~/.ssh/authorized_keys)"
    )
    print(f"Uploading public key to {host}...")
    stdout, stderr, code = sshpass_exec(host, port, password, remote_setup, timeout=15)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
95% confidence
Finding

The YARA hit is justified here because the code inserts an SSH key into authorized_keys, which is a classic persistence mechanism if abused. Even if intended for convenience, this pattern is dangerous in a remote-management tool because it silently expands long-term access to external systems.

Content

Scanner excerpt · scripts/remote_train.py (reported line 520)May include surrounding context.

python
pub_key_b64 = base64.b64encode(pub_key.encode()).decode()
    remote_setup = (
        f"mkdir -p ~/.ssh && "
        f"chmod 700 ~/.ssh && "
        f"touch ~/.ssh/authorized_keys && "
        f"chmod 600 ~/.ssh/authorized_keys && "
        f"grep -qF '{pub_key_b64}' ~/.ssh/.deepspeed_setup_marker 2>/dev/null || "
        f"(echo '{pub_key_b64}' >> ~/.ssh/.deepspeed_setup_marker && "
        f"echo '{pub_key_b64}' | base64 -d >> ~/.ssh/authorized_keys)"
    )
    print(f"Uploading public key to {host}...")
    stdout, stderr, code = sshpass_exec(host, port, password, remote_setup, timeout=15)
    if code != 0:
        print(f"Public key upload failed: {stderr}")
        print(f"\nYou can add the key manually instead. Here is the public key:")
        print(f"\n--- PUBLIC KEY ---")
        print(pub_key)
        print(f"--- END ---")
        print(f"\nAfter adding, run: python3 scripts/remote_train.py check-connection")
        return
    print(f"Public key configured on remote machi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly describes actions that would require powerful capabilities such as shell execution, file access, environment inspection, and likely remote access, but it declares no explicit tool scope or permissions. In an agent setting, that omission weakens containment and review, making it easier for the skill to be invoked with broader-than-expected authority.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- GPU(s) or accelerator(s) with DeepSpeed-supported backend (CUDA, ROCm, Intel XPU, etc.)
- DeepSpeed: `pip install deepspeed`
- Transformers, Datasets, PEFT (for LoRA support)
- sshpass: `sudo apt-get install sshpass` (for remote training)

## Plan Selection Workflow

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document establishes a hard rule that all remote operations must be dispatched through subagents, but later provides direct exec examples for remote setup and status actions. That inconsistency can cause implementers to bypass the intended async isolation and user-feedback model, increasing the chance of blocking behavior and unsafe direct execution of remote operations from the main agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide recommends generating an ed25519 key pair with no passphrase and frames it as the default convenience path without clearly warning the user about the risks of an unencrypted private key. If that key is stolen from the local system, an attacker can authenticate to the remote training host without needing any additional secret.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The remote-exec command exposes a general-purpose remote command execution primitive that goes beyond the stated fine-tuning workflow. In an agent skill context, generic remote execution materially expands the attack surface because a prompt, task description, or downstream component could invoke arbitrary commands on the remote host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide recommends --trust_remote_code true as a troubleshooting step without warning that this allows execution of arbitrary Python code supplied by a model repository. In a fine-tuning skill that may use third-party Hugging Face models, this materially increases the risk of users running untrusted code on local or remote GPU hosts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 179)May include surrounding context.

  1. Multi-GPU? Install MPI:
    bash
    pip install mpi4py
sudo apt-get install -y openmpi-bin libopenmpi-dev  # Ubuntu
pip install --force-reinstall --no-cache-dir mpi4py

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 185)May include surrounding context.

  1. Multi-GPU? Install MPI:
    bash
    pip install mpi4py
sudo apt-get install -y openmpi-bin libopenmpi-dev  # Ubuntu
pip install --force-reinstall --no-cache-dir mpi4py

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script exposes a trust_remote_code option and passes it to AutoTokenizer.from_pretrained and AutoModelForCausalLM.from_pretrained. In the Hugging Face ecosystem, enabling this permits execution of repository-provided Python code during model/tokenizer loading, which can run arbitrary code on the host and exceeds the expected scope of a training launcher.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/remote_train.py (reported line 129)May include surrounding context.

python
ssh_cmd = _build_ssh_base(host, port, use_key=True)
    ssh_cmd.append(cmd)
    try:
        result = subprocess.run(ssh_cmd, capture_output=True, text=True, timeout=timeout)
        if result.returncode == 0:
            return result.stdout, result.stderr, 0
    except subprocess.TimeoutExpired: