remote-macos-computer-use

• Outcome: Review
• Latest audit: Aug 30, 2026 · 3:44 PM UTC
• Version: 0.1.0

Overview

The skill is openly built for remote Mac control, but it sets up persistent SSH and desktop access with weak default guardrails.

Install only on a Mac and remote server you fully trust. Prefer a dedicated low-privilege macOS account, key-only SSH with tight authorized_keys restrictions, a server-side listener bound to localhost, and a clear way to unload the LaunchAgents and disable sshd. Do not use this on a personal or sensitive Mac unless you accept that the remote agent/server can see and operate the unlocked desktop and may reach the Mac over SSH.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script establishes a persistent reverse SSH tunnel that exposes the Mac's local SSH service to the remote server via `-R "$REVERSE_PORT:127.0.0.1:22"`. In the context of an MCP desktop-bridging skill, this grants the remote host shell-level access to the Mac, which is broader and more dangerous than narrowly scoped desktop control; if the remote server is compromised or misconfigured, an attacker can directly reach the Mac's SSH daemon through the tunnel.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises remote desktop control from a cloud host and persistent reverse-SSH connectivity, but does not prominently warn users that this grants broad access to screenshots, input, applications, and potentially sensitive local data. In this context, missing safety and privacy warnings materially increase the risk of unsafe deployment, credential exposure, and unintended surveillance or abuse if the remote host is compromised.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: These instructions enable SSH Remote Login with sudo and start a background auto-reconnect daemon, creating durable remote access that survives disruption. Without an explicit warning about the security implications and required hardening, users may expose a highly privileged control channel that can be reused by an attacker if the server, keys, or tunnel endpoint are compromised.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: Appending generated content directly to ~/.hermes/config.yaml modifies a persistent user configuration file and can create duplicate, conflicting, or unsafe configuration without review. While lower impact than the SSH-related issues, the lack of warning or validation can still cause unintended trust of a new MCP endpoint and silently expand agent capabilities.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to keep a remotely controllable Mac logged in, unlocked, auto-login enabled, and screen lock disabled to preserve GUI control. That materially weakens local device security: anyone with physical or remote access to the host session can inherit an already-authenticated desktop, and the reverse-tunnel/remote-control context makes this especially sensitive.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script silently creates and loads multiple LaunchAgents with RunAtLoad and KeepAlive, establishing persistence on the Mac at user login. In the context of a remote-computer-control skill, persistence materially increases risk because the remote control path survives reboots and user restarts without a strong interactive warning or confirmation step.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The generated tunnel script establishes a persistent reverse SSH tunnel exposing the Mac's local SSH service to the specified remote host via -R REVERSE_PORT:127.0.0.1:22. That creates a durable inbound management path from the remote server to the Mac, which is especially sensitive here because the skill is explicitly designed for unattended remote desktop control across networks.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cua-driver permissions grant

# 2. Enable SSH Remote Login
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. Start auto-reconnect background daemons

• Confidence: 92% confidence
• Finding: This command uses sudo to enable the system SSH daemon, changing OS-level service state with administrator privileges. In a skill whose purpose is remote computer control, privileged activation of remote login is security-sensitive because it increases attack surface and can establish a long-lived entry point to the Mac.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 2. Enable SSH Remote Login
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. Start auto-reconnect background daemons
REMOTE_HOST="<server-ip>" REMOTE_USER="ubuntu" REVERSE_PORT=2299 bash ./scripts/setup-mac.sh

• Confidence: 92% confidence
• Finding: This sudo command forcibly starts the SSH daemon immediately, making the remote access path live at once. In combination with the rest of the skill, that can expose the host to immediate remote reachability before users have applied key restrictions, firewall rules, or other safeguards.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cua-driver permissions grant

# 2. 开启远程登录 (SSH)
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. 启动后台守护进程（隧道自愈 + 防休眠）

• Confidence: 92% confidence
• Finding: The Chinese section repeats the same privileged instruction to enable the system SSH daemon, with the same security implications. Because it is an operational setup guide for persistent remote control, use of sudo here directly contributes to expanding the host's attack surface.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 2. 开启远程登录 (SSH)
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. 启动后台守护进程（隧道自愈 + 防休眠）
REMOTE_HOST="<云服务器IP>" REMOTE_USER="ubuntu" REVERSE_PORT=2299 bash ./scripts/setup-mac.sh

• Confidence: 92% confidence
• Finding: The Chinese section also repeats the immediate privileged start of sshd, which activates remote access without emphasizing that the system becomes reachable right away. This is dangerous in a remote-control skill because users may run the command before configuring authentication and network restrictions.

Session Persistence

Medium

• Category: Rogue Agent

Content

cua-driver permissions grant

# 2. Enable SSH Remote Login
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. Start auto-reconnect background daemons

• Confidence: 90% confidence
• Finding: `launchctl enable` configures the SSH daemon to persist across reboots, which is a classic persistence mechanism. In this skill's context, persistence is not accidental but it is still dangerous because it preserves a remote access channel on a user workstation and makes post-compromise access more durable.

Session Persistence

Medium

• Category: Rogue Agent

Content

cua-driver permissions grant

# 2. 开启远程登录 (SSH)
sudo launchctl enable system/com.openssh.sshd
sudo launchctl kickstart -k system/com.openssh.sshd

# 3. 启动后台守护进程（隧道自愈 + 防休眠）

• Confidence: 90% confidence
• Finding: The Chinese section repeats the persistent enablement of sshd via launchctl, again establishing reboot-surviving remote access. Because the skill is specifically about unattended remote control, persistent service activation materially increases exposure if the remote endpoint or credentials are abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "==> daemon LaunchAgent (com.trycua.driver)"
mkdir -p "$LA_DIR"
cat > "$LA_DIR/com.trycua.driver.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 98% confidence
• Finding: This line begins writing a LaunchAgent plist, which is a persistence mechanism on macOS. In a skill built for remote computer use, installing auto-starting agents without a strong consent gate increases the likelihood of unintended long-term remote access.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "==> daemon LaunchAgent (com.trycua.driver)"
mkdir -p "$LA_DIR"
cat > "$LA_DIR/com.trycua.driver.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 98% confidence
• Finding: This line begins writing a LaunchAgent plist, which is a persistence mechanism on macOS. In a skill built for remote computer use, installing auto-starting agents without a strong consent gate increases the likelihood of unintended long-term remote access.

Session Persistence

Medium

• Category: Rogue Agent

Content

chmod +x "$BRIDGE_DIR/tunnel.sh"

echo "==> tunnel LaunchAgent (com.remote-macos.tunnel)"
cat > "$LA_DIR/com.remote-macos.tunnel.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 99% confidence
• Finding: This line starts creation of a dedicated LaunchAgent for the reverse tunnel, causing the remote-access path to auto-start and self-heal via KeepAlive. Persistent remote SSH exposure is more dangerous here because the skill's purpose is unattended cross-network control of a Mac from a remote agent.

Session Persistence

Medium

• Category: Rogue Agent

Content

chmod +x "$BRIDGE_DIR/tunnel.sh"

echo "==> tunnel LaunchAgent (com.remote-macos.tunnel)"
cat > "$LA_DIR/com.remote-macos.tunnel.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 99% confidence
• Finding: This line starts creation of a dedicated LaunchAgent for the reverse tunnel, causing the remote-access path to auto-start and self-heal via KeepAlive. Persistent remote SSH exposure is more dangerous here because the skill's purpose is unattended cross-network control of a Mac from a remote agent.

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST

echo "==> keep-awake LaunchAgent (com.remote-macos.keep-awake)"
cat > "$LA_DIR/com.remote-macos.keep-awake.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 95% confidence
• Finding: This line starts creating a keep-awake LaunchAgent using caffeinate with RunAtLoad and KeepAlive, ensuring the system remains active for remote access. While less severe than the SSH tunnel, it still supports unattended persistence by preventing sleep and making remote control continuously available.

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST

echo "==> keep-awake LaunchAgent (com.remote-macos.keep-awake)"
cat > "$LA_DIR/com.remote-macos.keep-awake.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 95% confidence
• Finding: This line starts creating a keep-awake LaunchAgent using caffeinate with RunAtLoad and KeepAlive, ensuring the system remains active for remote access. While less severe than the SSH tunnel, it still supports unattended persistence by preventing sleep and making remote control continuously available.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "==> (re)load LaunchAgents"
for p in com.trycua.driver com.remote-macos.tunnel com.remote-macos.keep-awake; do
  launchctl unload "$LA_DIR/$p.plist" 2>/dev/null || true
  launchctl load "$LA_DIR/$p.plist" && echo "    loaded $p"
done

echo

• Confidence: 97% confidence
• Finding: This line actively loads the created LaunchAgents, immediately enabling persistent background execution for the driver, tunnel, and keep-awake components. In this remote-access context, automatically activating all of them without a hard confirmation materially increases exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "==> (re)load LaunchAgents"
for p in com.trycua.driver com.remote-macos.tunnel com.remote-macos.keep-awake; do
  launchctl unload "$LA_DIR/$p.plist" 2>/dev/null || true
  launchctl load "$LA_DIR/$p.plist" && echo "    loaded $p"
done

echo

• Confidence: 97% confidence
• Finding: This line actively loads the created LaunchAgents, immediately enabling persistent background execution for the driver, tunnel, and keep-awake components. In this remote-access context, automatically activating all of them without a hard confirmation materially increases exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.remote-macos.tunnel</string>

• Confidence: 86% confidence
• Finding: This launchd plist establishes persistence by configuring a background job that loads automatically and is kept alive. In the context of a remote-control bridge with reverse tunneling, this increases security risk because compromise of the referenced script or its SSH configuration would yield durable remote access that survives logout/reboot.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.remote-macos.tunnel</string>

• Confidence: 86% confidence
• Finding: This launchd plist establishes persistence by configuring a background job that loads automatically and is kept alive. In the context of a remote-control bridge with reverse tunneling, this increases security risk because compromise of the referenced script or its SSH configuration would yield durable remote access that survives logout/reboot.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.remote-macos.tunnel</string>
  <key>ProgramArguments</key>

• Confidence: 93% confidence
• Finding: The plist defines a launchd service that executes /bin/bash against a user-controlled script from the home directory at load time. Because it runs automatically and is configured for persistence, any tampering with tunnel.sh could result in repeated unauthorized code execution and sustained remote connectivity.

Session Persistence

Medium

• Category: Rogue Agent

Content

<key>KeepAlive</key><true/>
  <key>ThrottleInterval</key><integer>5</integer>
</dict>
</plist>

• Confidence: 90% confidence
• Finding: The KeepAlive and low ThrottleInterval settings ensure the tunnel process is automatically restarted, reinforcing persistence and resilience. In a skill specifically designed to maintain reverse-SSH remote control in the background, this makes any misuse or compromise more dangerous because access is self-healing after crashes or reboots.

Static analysis

No suspicious patterns detected.