Security audit

SSH Tunnel

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SSH guide, but some examples can weaken SSH trust checks or expose local services without enough warning.

Review this skill before installing if you rely on SSH for production or sensitive systems. Do not copy examples that disable host key checking, discard known_hosts, or accept changed host keys unless you have independently verified the server fingerprint. Be careful with 0.0.0.0 remote forwards and rsync --delete, because they can expose local services or remove remote files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:153
Finding: SSH Host Verification Disabled for Wildcard Hosts
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 153-158
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

text
Host *.dev.example.com User developer IdentityFile ~/.ssh/dev_key StrictHostKeyChecking no UserKnownHostsFile /dev/null

Technical Analysis

StrictHostKeyChecking no permits SSH connections without requiring the user to validate an unknown host key. Setting UserKnownHostsFile /dev/null additionally prevents accepted host keys from being retained for future comparison.

Together, these settings remove the persistent trust relationship that normally allows an SSH client to detect server impersonation or an unexpected host-key change. The configuration applies to every host matching *.dev.example.com, increasing the affected scope beyond a single explicitly identified development system.

Attack Path

A user adopts the documented wildcard SSH configuration.

An attacker gains a network interception position or redirects a matching hostname through DNS, routing, or local network manipulation.

The attacker presents an arbitrary SSH host key while impersonating the intended server.

Because strict host-key checking is disabled and no host keys are retained, the client connects without providing effective identity-change protection.

The user authenticates to and exchanges data with the attacker-controlled SSH endpoint.

The attacker can inspect data delivered to that endpoint, present a deceptive remote environment, and intercept traffic or files intentionally sent through the connection.

Impact Assessment

Successful exploitation compromises server authenticity and the confidentiality and integrity of the affected SSH session. Depending on how the connection is used, exposed assets may include passwords entered into the impersonated endpoint, commands, transferred files, remote service tra ...[truncated 394 chars]
Remediation: View remediation
Remediation Suggestions

Remove both StrictHostKeyChecking no and UserKnownHostsFile /dev/null.

Retain OpenSSH's normal known_hosts verification and require explicit confirmation for previously unknown hosts.

Provision expected host keys through an authenticated administrative channel before the first connection.

For managed environments, use SSH host certificates signed by a trusted host certificate authority.

If ssh-keyscan is used for provisioning, independently verify the resulting fingerprint; network retrieval alone does not establish authenticity.

Avoid applying weakened security controls to wildcard host patterns.

If disposable test systems require special handling, isolate the exception to a specific host alias and document the residual impersonation risk.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:329
Finding: Changed SSH Host Key Is Removed Without Fingerprint Verification
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 329-332
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

bash
# "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" # Server was reinstalled / IP reassigned ssh-keygen -R remote-host # Remove old fingerprint ssh user@remote-host # Accept new fingerprint

Technical Analysis

An SSH host-key change can result from legitimate server replacement, but it is also a primary warning of server impersonation or a man-in-the-middle attack. The documented remediation assumes a benign reinstall or IP reassignment and directs the user to remove the trusted key before independently validating the replacement.

Once the prior key is deleted, the next connection treats the replacement as a first-use key. If an attacker caused the original mismatch, accepting that replacement key establishes trust in the attacker-controlled endpoint.

Attack Path

An attacker intercepts or redirects traffic intended for remote-host.

The attacker presents a host key different from the trusted key stored by the client.

OpenSSH displays the remote-host-identification warning and blocks or warns about the connection.

The user follows the documented instructions and runs ssh-keygen -R remote-host.

The user reconnects and accepts the attacker's unverified fingerprint.

The malicious key becomes trusted, allowing the attacker to continue impersonating the server without subsequent host-key warnings.

The attacker can observe or manipulate activity directed to the impersonated SSH endpoint.

Impact Assessment

Exploitation can compromise the authenticity, confidentiality, and integrity of subsequent SSH sessions to the affected hostname. Potentially exposed information includes passwords submitted to the malicious endpoint, terminal input and output, transferred files, and application traffic i ...[truncated 318 chars]
Remediation: View remediation
Remediation Suggestions

Do not remove an existing host key until the reason for the change has been investigated.

Obtain the expected replacement fingerprint from a trusted administrator, server console, configuration-management system, cloud control plane, or another authenticated out-of-band channel.

Compare the complete fingerprint displayed by SSH with the independently obtained value.

Only after successful verification, remove the obsolete entry and install or accept the validated replacement key.

Where practical, deploy SSH host certificates or DNS SSHFP records protected by DNSSEC to support centrally managed verification.

Update the troubleshooting guidance to state explicitly that a changed host key may indicate an active man-in-the-middle attack.

Preserve logs and escalate unexpected key changes in production or privileged environments rather than treating them as routine connection errors.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The SSH config example disables host key verification with StrictHostKeyChecking no and discards known-host state with UserKnownHostsFile /dev/null, removing SSH's main protection against man-in-the-middle attacks. In a remote access skill this is especially dangerous because users may copy the pattern broadly for convenience and silently trust spoofed hosts.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
bash
# SSH is strict about permissions. Fix common issues: chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519 # Private key chmod 644 ~/.ssh/id_ed25519.pub # Public key chmod 600 ~/.ssh/config chmod 600 ~/.ssh/authorized_keys

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
bash
# SSH is strict about permissions. Fix common issues: chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519 # Private key chmod 644 ~/.ssh/id_ed25519.pub # Public key chmod 600 ~/.ssh/config chmod 600 ~/.ssh/authorized_keys

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
bash
# Make your local port 3000 accessible on the remote server's port 8080 ssh -R 8080:localhost:3000 user@remote-server # On the remote: curl http://localhost:8080 → hits your local :3000 # Expose to all interfaces on the remote (not just localhost) # Requires GatewayPorts yes in remote sshd_config

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The remote port-forward example binds the forwarded port to 0.0.0.0 on the remote host, which can expose the user's local service to any network that can reach that remote machine. In an SSH-tunneling skill this is contextually relevant, but presenting it without an explicit warning or safer default can lead to accidental overexposure of development dashboards, admin panels, or other local-only services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example generates a private key with an empty passphrase, which increases the chance that a stolen file can be used immediately for authentication. Although automation sometimes requires non-interactive credentials, omitting guidance on scope and storage controls makes the pattern easier to misuse.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
ssh-copy-id -i ~/.ssh/mykey_ed25519.pub user@remote-server

Manual (if ssh-copy-id unavailable)

cat ~/.ssh/mykey_ed25519.pub | ssh user@remote-server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

text
### SSH Agent

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
SSH is strict about permissions. Fix common issues:

chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519 # Private key chmod 644 ~/.ssh/id_ed25519.pub # Public key chmod 600 ~/.ssh/config chmod 600 ~/.ssh/authorized_keys

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The rsync --delete example can remove files on the destination that are not present locally, causing destructive data loss if the source path or trailing slash is wrong. In a file-transfer tutorial, users frequently copy commands directly, so the lack of an explicit deletion warning materially increases operational risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Missing User Warnings

Credential Access

Manual (if ssh-copy-id unavailable)

Credential Access

Manual (if ssh-copy-id unavailable)

Credential Access

Credential Access

External Transmission

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

Manual (if ssh-copy-id unavailable)

Sudo/Root Execution

SSH is strict about permissions. Fix common issues:

Missing User Warnings

Static analysis