T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:355
- Finding
- Maintainer-Specific SSH Deployment Target May Cause Unauthorized Source Transfer## Vulnerability Details **File Location**: `SKILL.md`, lines 355-369 **Vulnerability Type**: Maintainer-specific remote deployment instructions **Risk Level**: Medium ```bash ## 15. GMDEEP-SPECIFIC NOTES # SSH deploy scp MyStrategy.cs gmdeep:"C:/Users/stewa/Documents/NinjaTrader 8/bin/Custom/Strategies/" # Verify arrival ssh gmdeep "dir \"C:\Users\stewa\Documents\NinjaTrader 8\bin\Custom\Strategies\MyStrategy.cs\"" ### ⚠️ SSH Gotchas - Windows cmd.exe interprets `&&` and `|` before PowerShell - Split chained commands into separate SSH calls - NT8 Editor must be open for compilation (no CLI-only compile) ``` ### Technical Analysis The generic NinjaTrader development skill contains deployment commands tied to a maintainer-specific SSH alias, `gmdeep`, and a named Windows account path, `C:/Users/stewa/...`. An agent following the skill could copy a locally developed trading strategy to whichever remote system the user's SSH configuration resolves for that alias. The commands do not steal credentials, install persistence, or independently bypass SSH authentication. They operate with the permissions of an already configured SSH identity. Nevertheless, directing an agent to use a fixed third-party-style destination is outside the minimum privileges and resources required for generic NinjaScript guidance. The destination is neither selected nor verified by the user at execution time. The remote `ssh` command only performs a file existence check, but it still causes command execution on the resolved remote host. The more significant concern is the preceding `scp` operation, which can disclose proprietary strategy source code. ### Attack Path 1. A user installs or loads the skill for NinjaTrader development. 2. The agent reaches the GMDEEP-specific deployment procedure while deploying a generated strategy. 3. The local environment has an SSH alias named `gmdeep`, or the alias becomes resolvable through SSH co ...[truncated 1265 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `GMDEEP-SPECIFIC NOTES` section from the generic published skill and keep organization-specific deployment instructions in private documentation. 2. If remote deployment guidance is necessary, replace fixed values with explicit placeholders: ```bash scp MyStrategy.cs "<user-approved-host>:<user-approved-strategy-directory>/" ssh "<user-approved-host>" "dir \"<user-approved-strategy-file>\"" ``` 3. Require explicit user confirmation immediately before transferring a file or executing a remote command. The confirmation should show the resolved hostname, remote username, destination path, local source file, and command. 4. Resolve and validate SSH aliases before use, for example by reviewing the effective SSH configuration, and reject destinations that the user has not approved. 5. Avoid automatically deploying generated trading code. Present deployment commands for manual review unless the user explicitly requests execution. 6. Use a dedicated least-privilege remote account restricted to the required strategy directory. Where practical, constrain SSH keys with server-side restrictions. 7. Document that strategy files may contain proprietary or sensitive trading logic and must not be transferred to third-party infrastructure without authorization.