huawei-cloud-ascend-remote-connect

• Outcome: Review
• Latest audit: Aug 18, 2026 · 3:15 PM UTC
• Version: 1.0.1

Overview

This is a real remote administration skill, but its code can run broad SSH commands without consistently enforcing the promised confirmations and safeguards.

Install only if you intend to grant this skill broad SSH administration authority over authorized Ascend servers. Prefer non-root, least-privilege accounts, avoid inline passwords where possible, do not rely on the stated confirmation guarantees for one-shot or raw commands, and treat outputs such as environment variables, logs, crontabs, and authorized_keys as sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Raw mode: execute directly, bypass NL routing
    if raw:
        result = subprocess.run(
            ['ssh', '-o', f'ControlPath={ctrl_path}', '-o', 'ControlMaster=auto',
             '-o', 'BatchMode=yes', '-p', str(port), f'{user}@{host}', command],
            capture_output=True, text=True, timeout=60

• Confidence: 93% confidence
• Finding: This path executes arbitrary remote commands immediately when raw mode is enabled, with no confirmation, policy gate, or command allowlisting. In a skill explicitly advertised as requiring confirmation for sensitive actions, this creates a direct bypass that can run destructive commands on remote infrastructure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return 0
    else:
        # Direct shell command goes through fast mode
        result = subprocess.run(
            ['ssh', '-o', f'ControlPath={ctrl_path}', '-o', 'ControlMaster=auto',
             '-o', 'BatchMode=yes', '-p', str(port), f'{user}@{host}', command],
            capture_output=True, text=True, timeout=60

• Confidence: 93% confidence
• Finding: Even outside raw mode, commands classified as shell commands are executed directly over SSH without confirmation or high-risk filtering. Because the classifier accepts many administrative commands and shell syntax, users or upstream agents can trigger arbitrary remote execution contrary to the stated safety guarantees.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares powerful tool access (python3, bash, ssh) and clearly enables networked remote command execution, but the finding indicates those capabilities are not explicitly reflected in a permissions model. For a skill that opens SSH sessions and executes commands on remote hosts, undeclared network/shell capability materially increases the risk of users or orchestrators invoking it without understanding its reach.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is more than an Ascend troubleshooting helper: the documentation advertises general-purpose remote shell administration, package management, firewall changes, account manipulation, file operations, and raw command execution across multiple hosts. That scope expansion is dangerous because it turns the skill into a broad remote administration backdoor whose effective behavior exceeds the narrow task framing users may expect.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The validator returns ALLOWED for any command that does not match a blocked or sensitive regex, which makes the allowlist ineffective as a security control. In a remote SSH execution skill, an attacker can use unlisted but dangerous commands or slight syntax variations to bypass confirmation and execute destructive or persistence-establishing actions directly.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The executor falls back to direct execution of any user-supplied text whenever an SSH session is active, which turns the skill into a general-purpose remote shell rather than a bounded Ascend administration tool. Even with a validator, this broad execution path materially expands attack surface, enables unintended destructive actions, and violates least-privilege expectations for a narrowly described skill.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The system module exposes `env | sort | head -40` through a natural-language trigger, which can reveal secrets such as tokens, proxy credentials, internal endpoints, and cloud configuration values. Environment dumping is not necessary for the stated Ascend remote-management purpose and exposes sensitive data without meaningful user warning.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The security module can generate a new root SSH keypair on demand, which goes beyond passive auditing into credential creation and access enablement. In a remote administration context, this can facilitate persistence or unauthorized future access if the generated key is later installed or misused.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The help text claims sensitive operations require confirmation and that high-risk commands are blocked, but earlier code paths allow immediate arbitrary command execution. This mismatch is dangerous because users and calling agents may rely on stated protections that do not actually exist, increasing the chance of accidental or unauthorized destructive actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The one-shot execution flow directly runs remote commands, including natural shell commands, without any confirmation step despite the manifest promising confirmation for sensitive operations. This is a control-bypass vulnerability because consumers of the skill are led to believe that dangerous actions will be gated when they are not.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The Paramiko fallback reproduces the same issue: raw execution directly calls exec_command on the remote host without any confirmation or policy enforcement. Because this fallback activates when the faster SSH path fails, the unsafe behavior remains reachable and undermines the manifest's promised safeguards.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The connection pool keys sessions only by host:port, so a later request for the same host and port but a different username or credential set can silently reuse an already-authenticated SSH session. In a multi-user or multi-step agent workflow, this can cause commands to run under the wrong remote identity, bypass intended authentication boundaries, and leak access across requests.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Broad trigger words like 'SSH', 'remote', and 'NPU' make accidental or implicit activation more likely in normal conversations about infrastructure. Because this skill can establish SSH connections and execute privileged actions, overbroad activation increases the chance of unintended invocation in a high-risk context.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The example sudoers entry grants the named user unrestricted passwordless root access via sudo for all commands. In a skill centered on remote SSH access and system administration, this meaningfully expands blast radius: compromise of the SSH account or accidental command execution becomes full host compromise without any privilege escalation barrier.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to modify `/etc/ssh/sshd_config` and restart `sshd` to enable password authentication, which weakens SSH security and changes system-wide access behavior. In a skill specifically designed for temporary remote access, recommending this without a prominent warning, scope limitation, or rollback guidance increases the risk of exposing the host to unauthorized access or service disruption.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide recommends executing `sudo npu-smi info` remotely without any safety or authorization warning. Although the command shown is read-oriented, normalizing privileged remote execution in an SSH troubleshooting skill can encourage unnecessary sudo usage and broaden the blast radius if users substitute more dangerous commands.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The verification guide instructs users to authenticate over SSH as root and to pass the password directly on the command line without any accompanying warning about least-privilege access, secret handling, or safer alternatives. In a remote-admin skill, normalizing root login and inline password usage increases the chance of credential exposure, accidental logging, and immediate full-system compromise if the credentials are mishandled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Sensitive environment-variable access is exposed as a routine informational command without explicit disclosure that secrets may be printed back to the requester. In a remote SSH skill, this increases risk of credential leakage through chat logs, telemetry, or unauthorized operators.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill reads and returns `authorized_keys` contents for root and users without an explicit warning that credential material and trusted-access configuration will be exposed. While public keys are not private keys, they still reveal access relationships, usernames, infrastructure patterns, and can disclose sensitive trust state that should not be broadly surfaced.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The direct execution path provides arbitrary subprocess/shell execution once connected, but the user-facing flow does not consistently disclose that free-form text will be run on the remote host. This creates a dangerous mismatch between natural-language assistant expectations and actual shell execution semantics.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Raw SSH execution occurs with no warning, disclosure, or confirmation, which is risky in an agent skill that may be triggered programmatically or through natural-language workflows. The context makes this more dangerous because the skill is designed for privileged remote administration of Ascend servers, where a single command can alter disks, containers, or system state.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Paramiko raw path has the same lack of warning or disclosure before arbitrary remote execution. In this operational context, undisclosed execution can lead to unintended administrative changes on production accelerators or hosts.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Minimum required permissions on target server:**
- SSH access (port 22 or custom)
- Sudo privileges for system management operations

## Core Workflow

• Confidence: 85% confidence
• Finding: Documenting sudo privileges as a minimum requirement is risky in a skill that also supports remote command execution, disk management, firewall changes, and user management. If the skill is triggered unintentionally or misused, elevated privileges greatly amplify the blast radius from host misconfiguration to full system compromise or destructive changes.

Credential Access

High

• Category: Privilege Escalation

Content

elif action == 'ssh_config':
                    return self._exec_simple('SSH config', 'grep -v "^#" /etc/ssh/sshd_config 2>/dev/null | grep -v "^$"')
                elif action == 'ssh_keys':
                    return self._exec_simple('SSH keys', 'echo "=== root authorized_keys ==="; cat /root/.ssh/authorized_keys 2>/dev/null || echo "none"; for user in $(ls /home/ 2>/dev/null | head -5); do echo; echo "=== $user ==="; cat /home/$user/.ssh/authorized_keys 2>/dev/null || echo "none"; done')
                elif action == 'security_check':
                    return self._exec_simple('security check', 'echo "=== open ports ==="; ss -tlnp 2>/dev/null | head -20; echo; echo "=== firewall ==="; iptables -L -n 2>/dev/null | head -10 || echo "none"; echo; echo "=== SSH config ==="; grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config 2>/dev/null; echo; echo "=== failed logins (recent 5) ==="; lastb -10 2>/dev/null | head -5 || echo "none"')
                elif action == 'system_users':

• Confidence: 93% confidence
• Finding: This duplicate finding maps to the same raw access to `authorized_keys`, which exposes privileged trust relationships and account-level access configuration. Although useful for audits, unrestricted disclosure of the file contents is more than is necessary for routine support workflows.

Credential Access

High

• Category: Privilege Escalation

Content

elif action == 'ssh_config':
                    return self._exec_simple('SSH config', 'grep -v "^#" /etc/ssh/sshd_config 2>/dev/null | grep -v "^$"')
                elif action == 'ssh_keys':
                    return self._exec_simple('SSH keys', 'echo "=== root authorized_keys ==="; cat /root/.ssh/authorized_keys 2>/dev/null || echo "none"; for user in $(ls /home/ 2>/dev/null | head -5); do echo; echo "=== $user ==="; cat /home/$user/.ssh/authorized_keys 2>/dev/null || echo "none"; done')
                elif action == 'security_check':
                    return self._exec_simple('security check', 'echo "=== open ports ==="; ss -tlnp 2>/dev/null | head -20; echo; echo "=== firewall ==="; iptables -L -n 2>/dev/null | head -10 || echo "none"; echo; echo "=== SSH config ==="; grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config 2>/dev/null; echo; echo "=== failed logins (recent 5) ==="; lastb -10 2>/dev/null | head -5 || echo "none"')
                elif action == 'system_users':

• Confidence: 93% confidence
• Finding: This duplicate finding maps to the same raw access to `authorized_keys`, which exposes privileged trust relationships and account-level access configuration. Although useful for audits, unrestricted disclosure of the file contents is more than is necessary for routine support workflows.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/verification-method.md:25

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:145