Security audit

remote-macos-computer-use

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate remote Mac control setup, but it creates durable remote desktop and SSH access with under-scoped safety controls.

Install only if you intentionally want an always-on remote agent to control a logged-in, unlocked Mac. Before using it, replace curl-to-Bash with a verified installer, use a dedicated low-privilege Mac account and restricted SSH key, confirm the reverse tunnel is loopback-only, enforce bounded cua-driver mode in the LaunchAgent, review generated plist/YAML files before loading or appending them, and document how to unload LaunchAgents, remove the SSH key, and disable Remote Login.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:32
Finding: Unverified Remote Installer Is Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-mac.sh:35
Finding: Unvalidated Environment Values Are Embedded in Persistent Shell and LaunchAgent Files
Content: View full analysis
tunnel wrapper" mkdir -p "$BRIDGE_DIR" cat > "$BRIDGE_DIR/tunnel.sh" < \$S" >> "\$LOG" ssh -N \ -o ExitOnForwardFailure=yes \ -o ServerAliveInterval=30 \ -o ServerAliveCountMax=3 \ -o ConnectTimeout=15 \ -o StrictHostKeyChecking=accept-new \ -o BatchMode=yes \ -R $REVERSE_PORT:127.0.0.1:22 \ "\$S" >>"\$LOG" 2>&1 echo "[$(date '+%F %T')] tunnel exited (rc=\$?), retry in 5s" >> "\$LOG" sleep 5 done TUN chmod +x "$BRIDGE_DIR/tunnel.sh" ``` Environment-controlled paths and executable names are also inserted into XML without XML encoding: ```bash cat > "$LA_DIR/com.trycua.driver.plist" < Labelcom.trycua.driver ProgramArguments $CUA_BIN serve RunAtLoad KeepAlive StandardOutPath$HOME/.cua-driver/serve.out.log StandardErrorPath$HOME/.cua-driver/serve.err.log PLIST ``` The generated files are then loaded as persistent services: ```bash for p in com.trycua.driver com.remote-macos.tunnel com.remote-macos.keep-awake; do launchctl unload "$LA_DIR/$p.plist" 2>/dev/null || true launchctl load "$LA_DIR/$p.plist" && echo " loaded $p" done ``` ### Technical Analysis `REMO ...[truncated 2084 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:55
Finding: SSH Key Authorization Grants a General User Shell Beyond the MCP Requirement
Content: View full analysis
@127.0.0.1 # only after tunnel is up ``` The Skill also permits unrestricted manual installation of the key: ```text Or copy the public key manually into `/Users//.ssh/authorized_keys`. ``` The configured client later uses that identity to run the MCP executable: ```bash ssh -p -i ~/.ssh/id_ed25519_mac @127.0.0.1 cua-driver mcp ``` ### Technical Analysis Adding a normal public key to the interactive Mac user's `authorized_keys` generally authorizes more than the one documented `cua-driver mcp` command. The instructions do not apply a forced command, `restrict`, forwarding prohibitions, PTY restrictions, source constraints, or a dedicated low-privilege account. Consequently, possession of the private key can allow arbitrary SSH commands as the desktop user through the reverse tunnel. This exceeds the minimum privilege necessary for an MCP-only bridge. The generated private key also has an empty passphrase (`-N ""`). Batch operation can justify a noninteractive key, but it increases reliance on server-side file protection and makes theft of the key immediately usable. The reverse tunnel's default listener is intended to be loopback-only on the server, which reduces network exposure. It does not protect against compromise of the server account, processes on that server, or theft of the private key. ### Attack Path 1. An attacker compromises the cloud-server account, an agent process on that server, or the unencrypted private key file. 2. The attacker connects to `127.0.0.1:` through the established reverse tunnel. 3. The Mac SSH daemon accepts the authorized key for the ...[truncated 696 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup-mac.sh:35
Finding: Persistent Desktop-Control Daemon Does Not Enforce the Documented Bounded Mode
Content: View full analysis
ProgramArguments $CUA_BIN serve RunAtLoad KeepAlive ``` The shipped template has the same behavior: ```xml ProgramArguments /Applications/CuaDriver.app/Contents/MacOS/cua-driver serve RunAtLoad KeepAlive ``` However, the Skill's safety section recommends arguments that are not installed: ```bash cua-driver serve --permission-mode bounded --capability-manifest ``` ### Technical Analysis The Skill correctly recognizes that GUI automation should default to a bounded mode with a reviewed capability manifest. The actual setup script and template do not implement that recommendation. The installed service therefore delegates its security posture to the external program's unspecified defaults. There is no installer-level guarantee that only reviewed applications or capabilities will be exposed. Because the service has `RunAtLoad` and `KeepAlive`, the potentially broad control surface is continuously available whenever the user session is active. The Mac is also expected to remain logged in, awake, and unlocked, increasing the practical sensitivity of excessive GUI permissions. ### Attack Path 1. A user follows the setup instructions and grants Accessibility and Screen Recording permissions to `CuaDriver.app`. 2. `setup-mac.sh` installs and loads a persistent daemon using only `cua-driver serve`. 3. No bounded-mode argument or validated capability manifest is supplied. 4. The remote M ...[truncated 889 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gen-mcp-config.py:13
Finding: Environment-Controlled Values Are Emitted as Unsafe YAML
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (74)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users to execute a network-fetched shell script with curl-piped-to-bash, then enable SSH login daemons and background reconnect services, without any strong warning or verification steps. This is dangerous because it combines unverified remote code execution with persistent remote access, so compromise of the download source, DNS/TLS trust chain, or operator mistakes could immediately lead to full host takeover or long-lived backdoor access.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The README directs users to run a shell command that executes a remotely fetched install script, a classic high-risk pattern because the content is not pinned or verified before execution. In this skill, the danger is amplified by the fact that the installed component is then granted powerful desktop-control permissions, so any compromise of the installer source could lead to immediate arbitrary code execution plus surveillance and input-control capabilities.
Content: Scanner excerpt · README.md (reported line 58)May include surrounding context.
Step 1: On Your Mac (One-time)

bash
# 1. Install cua-driver & grant Accessibility/Screen permissions /bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)" cua-driver permissions grant # 2. Enable SSH Remote Login

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The README instructs use of a specific SSH private key path to generate MCP configuration, which normalizes agent workflows that depend on stored credentials for remote desktop access. This is risky because the skill is connecting a remote agent to a local machine; if the server, agent config, or key permissions are weak, the private key reference can facilitate unauthorized reuse or compromise of the Mac access path.
Content: Scanner excerpt · README.md (reported line 72)May include surrounding context.
Step 2: On Your Server (Configure Hermes)

Generate the MCP config fragment and append to ~/.hermes/config.yaml:

bash
MAC_USER="<mac-username>" REVERSE_PORT=2299 REMOTE_KEY=~/.ssh/id_ed25519_mac python3 ./scripts/gen-mcp-config.py >> ~/.hermes/config.yaml

Step 3: In Hermes Chat

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This is the Chinese-language duplicate referencing an SSH private key path in generated MCP configuration, with the same credential exposure risk. In this skill's context, the key is part of the control path for remote access to the Mac, so misuse or leakage could directly enable unauthorized desktop control.
Content: Scanner excerpt · README.md (reported line 140)May include surrounding context.
第二步：在云端服务器配置 Hermes

生成 MCP 配置并追加到 ~/.hermes/config.yaml：

bash
MAC_USER="<Mac用户名>" REVERSE_PORT=2299 REMOTE_KEY=~/.ssh/id_ed25519_mac python3 ./scripts/gen-mcp-config.py >> ~/.hermes/config.yaml

第三步：在 Hermes 对话中刷新生效

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill requires installing SSH key-based access into the Mac user's authorized_keys to permit persistent remote entry from the server. In the context of an always-on reverse tunnel and unlocked desktop, that credential path creates durable remote access that could be abused if the server, private key, or target account is compromised.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
- A Mac that stays **logged in, awake, unlocked** (see "Background persistence"). - macOS Accessibility + Screen Recording grants for `CuaDriver.app`. - SSH access **from the server to the Mac** (Remote Login enabled + the server's public key in the Mac's `~/.ssh/authorized_keys`). - cua-driver installed on the Mac (`/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"`). > **Privacy note:** replace every `<...>` placeholder with your own values. None of the scripts contain a real username or server address by default; you supply them via environment variables. The default `REMOTE_USER=ubuntu` is just the common cloud-image user and is not tied to anyone.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The skill instructs users to execute a remote install script fetched via curl directly into bash, which is a classic supply-chain and command-injection risk. If the hosting domain, TLS trust, CDN path, or script content is compromised, the user would execute attacker-controlled code on the Mac with the permissions needed to establish remote-control infrastructure.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
- A Mac that stays **logged in, awake, unlocked** (see "Background persistence"). - macOS Accessibility + Screen Recording grants for `CuaDriver.app`. - SSH access **from the server to the Mac** (Remote Login enabled + the server's public key in the Mac's `~/.ssh/authorized_keys`). - cua-driver installed on the Mac (`/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"`). > **Privacy note:** replace every `<...>` placeholder with your own values. None of the scripts contain a real username or server address by default; you supply them via environment variables. The default `REMOTE_USER=ubuntu` is just the common cloud-image user and is not tied to anyone.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Adding a server-controlled key to the Mac's authorized_keys is the mechanism that grants remote access. Because this skill is specifically designed for persistence and background reconnection, compromise of the server side would directly grant access to the Mac session and its GUI control path.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

macOS recently tightened systemsetup -setremotelogin on to require Full Disk Access. The launchctl enable/kickstart path avoids that. If sshd won't start, check /etc/ssh/sshd_config for stray client options (e.g. ServerAliveInterval, ServerAliveCountMax) — they are invalid there and make sshd exit immediately.

3. On the server: set up key auth to the Mac

On the server, generate a keypair, then add its public key to the Mac's ~/.ssh/authorized_keys:

bash
ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519_mac ssh-copy-id -i ~/.ssh/id_ed25519_mac.pub -p <revport> <mac_user>@127.0.0.1 # only after tunnel is up

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Manual placement of a public key into /Users/<mac_user>/.ssh/authorized_keys establishes persistent trust for remote login. In this skill's context, that trust is coupled to a reverse tunnel and unlocked desktop, which raises the consequence of any credential misuse.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519_mac ssh-copy-id -i ~/.ssh/id_ed25519_mac.pub -p <mac_user>@127.0.0.1 # only after tunnel is up

text
Or copy the public key manually into `/Users/<mac_user>/.ssh/authorized_keys`. ### 4. On the Mac: run this skill's setup script (daemon + tunnel + keep-awake) ```bash

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/gen-mcp-config.py (reported line 8)May include surrounding context.
python
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/gen-mcp-config.py (reported line 14)May include surrounding context.
python
~/.hermes/config.yaml under `mcp_servers:` (indent to that level). REQUIRED env: MAC_USER (the macOS account on the Mac) OPTIONAL env: REVERSE_PORT (default 2299) REMOTE_KEY (default ~/.ssh/id_ed25519_mac) MAC_CUA (default /Users/<MAC_USER>/.local/bin/cua-driver) SERVER_NAME (default mac_computer) """

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/setup-mac.sh (reported line 124)May include surrounding context.
sh
echo echo "==> human-only steps (cannot be automated):" echo " 1. Grant CuaDriver permissions: cua-driver permissions grant" echo " 2. Enable Remote Login: sudo launchctl enable system/com.openssh.sshd && sudo launchctl kickstart -k system/com.openssh.sshd" echo " 3. Auto-login + no lock (System Settings -> Users & Groups -> Login Options; Screen Saver -> Never)" echo " 4. Add the server's SSH public key to ~/.ssh/authorized_keys" echo

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The script instructs the user to place the server's SSH public key into ~/.ssh/authorized_keys, granting that remote server passwordless login capability to the Mac account. In combination with the reverse tunnel and persistent daemonization, this creates durable remote access that becomes dangerous if the server or its key material is compromised.
Content: Scanner excerpt · scripts/setup-mac.sh (reported line 126)May include surrounding context.
sh
echo " 1. Grant CuaDriver permissions: cua-driver permissions grant" echo " 2. Enable Remote Login: sudo launchctl enable system/com.openssh.sshd && sudo launchctl kickstart -k system/com.openssh.sshd" echo " 3. Auto-login + no lock (System Settings -> Users & Groups -> Login Options; Screen Saver -> Never)" echo " 4. Add the server's SSH public key to ~/.ssh/authorized_keys" echo echo "Verify later with: bash ./scripts/doctor-mac.sh"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly promotes remote/cloud control of a local Mac desktop, including clicking, typing, screenshots, and app execution, but does not prominently warn users about the privacy and security implications of granting Accessibility, Screen Recording, and remote-control capabilities. In this context, the omission is dangerous because the skill is specifically designed to bridge a local desktop to a remote agent, materially increasing the risk of surveillance, unauthorized actions, and sensitive data exposure if the server or agent is compromised.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The README states that Hermes will automatically execute SKILL.md to guide setup, which encourages autonomous execution of installation and connectivity steps. In a skill that provisions remote desktop control and SSH tunneling, automatic execution materially increases risk because users may trigger sensitive actions without reviewing commands that establish persistence or grant broad permissions.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.

Prompt Example: "Help me set up remote macOS computer use. My cloud server IP is 203.0.113.10, server user is ubuntu, and my Mac user is alice."

Hermes will automatically execute SKILL.md to guide the setup:

Rendering diagram...

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: This command enables the system OpenSSH daemon with sudo, modifying system-wide remote access behavior. In the context of a skill designed to let a remote agent control a local Mac, enabling SSH is a meaningful security-sensitive action because it expands the attack surface and can facilitate continued remote entry if the remote host, credentials, or tunnel are compromised.
Content: Scanner excerpt · README.md (reported line 62)May include surrounding context.
md
cua-driver permissions grant # 2. Enable SSH Remote Login sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. Start auto-reconnect background daemons

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Enabling sshd via launchctl establishes persistent remote-login capability across reboots. For a skill whose purpose is durable remote desktop access, persistence is especially sensitive because it can outlive user awareness and maintain an access channel even after the immediate setup session ends.
Content: Scanner excerpt · README.md (reported line 62)May include surrounding context.
md
cua-driver permissions grant # 2. Enable SSH Remote Login sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. Start auto-reconnect background daemons

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This sudo command force-starts the SSH daemon, immediately activating remote login service. That is dangerous in this context because the skill's purpose is to establish remote control and persistence, so starting sshd right away can expose the host to remote access before the user has fully reviewed key restrictions, firewall rules, and trust boundaries.
Content: Scanner excerpt · README.md (reported line 63)May include surrounding context.
md
# 2. Enable SSH Remote Login sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. Start auto-reconnect background daemons REMOTE_HOST="<server-ip>" REMOTE_USER="ubuntu" REVERSE_PORT=2299 bash ./scripts/setup-mac.sh

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Appending generated MCP configuration directly into ~/.hermes/config.yaml changes how the agent connects to external systems and may embed or reference sensitive SSH key material, yet the README does not warn users about these trust and exposure implications. In this skill's context, this is risky because the configuration is specifically wiring a remote agent to a local desktop over SSH, so unnoticed config changes can broaden agent reach and persist access beyond user intent.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: This is the Chinese-language duplicate of the sudo command enabling system SSH service, carrying the same risk of expanding remote access on the Mac. Because the skill is expressly for remote desktop control, enabling OS-level SSH without a strong warning or hardening guidance creates a meaningful security exposure.
Content: Scanner excerpt · README.md (reported line 130)May include surrounding context.
md
cua-driver permissions grant # 2. 开启远程登录 (SSH) sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. 启动后台守护进程（隧道自愈 + 防休眠）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: This Chinese-language duplicate enables persistent SSH service through launchctl, preserving remote access over time. In a remote-control skill, such persistence increases the risk of unnoticed continued access if the remote endpoint or credentials are later compromised.
Content: Scanner excerpt · README.md (reported line 130)May include surrounding context.
md
cua-driver permissions grant # 2. 开启远程登录 (SSH) sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. 启动后台守护进程（隧道自愈 + 防休眠）

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This Chinese-language command immediately starts the SSH daemon with elevated privileges, making remote login active at once. In a setup that also configures reverse tunneling and background persistence, immediate activation increases the chance of unintended exposure if the surrounding security controls are not yet in place.
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
md
# 2. 开启远程登录 (SSH) sudo launchctl enable system/com.openssh.sshd sudo launchctl kickstart -k system/com.openssh.sshd # 3. 启动后台守护进程（隧道自愈 + 防休眠） REMOTE_HOST="<云服务器IP>" REMOTE_USER="ubuntu" REVERSE_PORT=2299 bash ./scripts/setup-mac.sh

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Tool Parameter Abuse

Step 1: On Your Mac (One-time)

Credential Access

Step 2: On Your Server (Configure Hermes)

Step 3: In Hermes Chat

Credential Access

第二步：在云端服务器配置 Hermes

第三步：在 Hermes 对话中刷新生效

Credential Access

Tool Parameter Abuse

Credential Access

3. On the server: set up key auth to the Mac

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Chaining Abuse

Credential Access

Missing User Warnings

Autonomous Decision Making

Sudo/Root Execution

Session Persistence

Sudo/Root Execution

Missing User Warnings

Sudo/Root Execution

Session Persistence

Sudo/Root Execution