Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple SCP file-transfer wrapper whose network file-copy behavior is clear and purpose-aligned, though users should verify paths and destinations carefully.
Install only if you want an agent to perform SCP transfers. Before use, check the exact source path, destination host, account, and remote path, because SCP can send local data to another machine and may overwrite remote files.
The skill describes shell-capable behavior for copying files to and from remote hosts, but it does not declare any tool scope such as allowed-tools or permissions. This weakens enforcement and reviewability, because an agent may invoke shell functionality without explicit restriction, increasing the chance of unintended command execution or misuse during file transfer tasks.
The skill encourages SCP-based transfers to remote hosts but does not warn users that actions may overwrite destination files or transmit sensitive local data off-host. In an agent setting, the lack of a clear warning increases the risk of accidental data exfiltration, overwriting backups, or sending files to the wrong remote system.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
parser.add_argument('src')
parser.add_argument('dst')
args = parser.parse_args()
subprocess.run(['scp', args.src, args.dst])
The script invokes the external scp command directly via subprocess.run(...), which can initiate network transfer of files. While the docstring names the tool, the file contains no confirmation prompt, logging, or explicit warning to the user about performing a network copy operation.
No suspicious patterns detected.