ClawHub
Back to skill

Security audit

SSH Config Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate SSH config manager, but it edits sensitive SSH settings and tests connections in ways that need careful review before installation.

Install only if you are comfortable letting this skill read and modify SSH client configuration. Review changes before applying them, keep your own backup of ~/.ssh/config, avoid testing hosts from untrusted config files, and be aware that malformed entries could disrupt SSH access or change connection behavior.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/main.py:274
Finding

SSH Command-Line Option Injection Through an Unvalidated Hostname

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:25
Finding

SSH Configuration Backups and New Configuration Files Are Created Without Enforced Restrictive Permissions

Content
View full analysis
str: """Create a backup of the current config file.""" if not os.path.exists(self.config_path): return "" timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S") backup_path = os.path.join(self.backup_dir, f"config_backup_{timestamp}") try: with open(self.config_path, 'r') as src: with open(backup_path, 'w') as dst: dst.write(src.read()) ``` The main configuration is also written without enforcing a secure mode: ```python def write_config(self, hosts: List[Dict[str, Any]]) -> bool: """Write hosts back to SSH config file.""" try: with open(self.config_path, 'w') as f: for host in hosts: f.write(f"Host {host['host']}\n") for key, value in host['options'].items(): f.write(f" {key} {value}\n") f.write("\n") ``` ### Technical Analysis The backup directory and files are created using default process permissions. Their final modes therefore depend on the environment's `umask`. Under a common `022` umask, a newly created backup can be readable by other local users. SSH configuration files may contain internal hostnames, usernames, proxy routes, network topology, and paths to private identity files. The implementation does not read or copy private-key contents, but disclosure of SSH configuration metadata can still materially assist later attacks. The direct write to the destination also lacks an atomic replacement workflow. If the process is interrupted, the existing configuration may be left ...[truncated 962 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (16)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
python3 scripts/main.py list

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
python3 scripts/main.py list

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

--hostname server.example.com
--user ec2-user
--port 2222
--identity ~/.ssh/id_rsa
--tag "aws,production"
--description "Production web server"

text

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises capabilities to read and write files and invoke shell commands, but it does not declare any explicit tool scope or permission boundaries. For a tool that edits ~/.ssh/config and tests SSH connections, the absence of scoped permissions increases the chance of overbroad file modification or command execution beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Describing add/remove/edit operations on ~/.ssh/config without an explicit caution underplays the sensitivity of SSH client configuration. Even non-malicious edits can lock users out of hosts, redirect traffic via attacker-controlled options such as ProxyCommand, or weaken expected connection behavior if changes are applied carelessly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented generate --output ~/.ssh/config workflow can overwrite a critical authentication configuration file without a prominent warning about disruption risk. A malformed or unintended overwrite of ~/.ssh/config can break access to infrastructure, alter routing through bastions/proxies, or cause users to connect with unsafe defaults.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 288)May include surrounding context.

python
try:
            start_time = time.time()
            result = subprocess.run(
                ssh_command,
                capture_output=True,
                text=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file describes operations that alter the user's SSH configuration, including adding, editing, and removing hosts. Although it mentions backups before changes, it does not clearly warn users that the tool modifies a sensitive local config file whose mistakes could disrupt SSH access or connectivity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.