Security audit

ssh-lab

Security checks across malware telemetry and agentic risk

Overview

This is a mostly coherent SSH server-management skill, but it gives agents broad remote command and file-transfer power with weak scoping and a local command-injection risk in host resolution.

Install only if you are comfortable giving the agent SSH-based administrative reach over the hosts in your SSH config. Review host aliases for shell metacharacters, avoid broad 'all' commands unless intentional, treat JSON/status output as potentially containing sensitive command-line data, and prefer dry-run for sync operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The probe goes beyond basic GPU telemetry and enumerates full command lines for GPU-associated processes by reading /proc/<pid>/cmdline (with a ps fallback). Command lines commonly contain sensitive data such as file paths, usernames, internal service names, model names, tokens, API keys, and credentials passed as CLI arguments, so collecting and exporting them increases privacy and secret-exposure risk without an obvious need for core GPU health monitoring.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation criteria are broad enough to match ordinary discussion of servers, GPUs, or common commands like nvidia-smi, which can cause the skill to engage outside a clearly scoped user request. In a skill that enables SSH access and remote operations, accidental invocation increases the chance of unnecessary remote probing or command execution on sensitive infrastructure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly supports executing arbitrary remote commands on a selected host or on all hosts, but it does not document any safety guardrails, confirmation requirements, or warnings about impact. In the context of SSH-based administration across multiple servers, this materially raises the risk of destructive, privacy-impacting, or fleet-wide actions being taken too easily.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list contains broad, generic phrases such as "GPU", "server status", and "remote server" that are likely to match ordinary user requests outside the intended scope. This can cause the skill to activate unexpectedly for sensitive infrastructure-related prompts, increasing the chance that a user is routed into a tool capable of remote command execution, file transfer, and log access when they did not explicitly intend to use it.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code reads complete process command lines from /proc for running GPU jobs without any indication of user disclosure, consent, or scope limitation. In an agent skill context, that makes the behavior more dangerous because the collected data can be silently forwarded elsewhere, turning routine system inspection into covert collection of potentially sensitive operational and user data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code interpolates the host alias directly into a shell command passed to execSync, which invokes a shell. If an attacker can control or influence the alias value, they can inject shell metacharacters and execute arbitrary local commands under the current user. In this context, aliases come from user input, custom config, or parsed SSH config entries, so the skill context makes this more dangerous rather than less.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/commands/sync.ts:77

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ssh/config.ts:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/ssh/exec.ts:210