Perry Coding Agents

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:39 AM UTC
• Version: 1.5.0

Overview

This skill is meant to delegate coding work to remote agents, but it gives them broad long-running remote execution and callback authority that users should review carefully.

Install only if you intentionally want this agent to delegate coding tasks to Perry remote workspaces. Use trusted workspace IPs, prefer pinned SSH host keys instead of disabled checking, avoid long-lived callback tokens, require explicit approval before dispatching work, and keep it away from sensitive repositories unless remote background agents creating branches or PRs is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented dispatch pattern instructs a remote agent to make an outbound HTTP callback to the caller and include a bearer token. That creates an external data transmission path and exposes an authentication secret to a remote execution context, increasing the risk of token leakage, misuse, or unintended data exfiltration if the remote workspace is compromised or the callback payload is influenced.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents a network callback carrying a bearer token but provides no warning that data and credentials are being transmitted from a remote workspace back to the caller. This reduces user awareness and consent around secret handling and can lead to unsafe deployment of a callback channel over plaintext HTTP.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 3. Dispatch (background, no timeout)
ssh -o StrictHostKeyChecking=no workspace@100.109.173.45 "cd ~/perry && /home/workspace/.opencode/bin/opencode run 'Add bearer token auth to all API endpoints. Create PR when done.

When finished: curl -X POST http://${WAKE_IP}:18789/hooks/wake -H \"Content-Type: application/json\" -H \"Authorization: Bearer <token>\" -d \"{\\\"text\\\": \\\"Done: Auth PR created\\\", \\\"mode\\\": \\\"now\\\"}\"
'" &

# 4. Wake received → check CI

• Confidence: 97% confidence
• Finding: curl -X POST http://${WAKE_IP}:18789/hooks/wake -H \"Content-Type: application/json\" -H \"Authorization: Bearer <token>\" -d

Session Persistence

Medium

• Category: Rogue Agent

Content

Dispatch tasks to OpenCode/Claude Code on Perry workspaces.

## Rules
- **Always create dex task FIRST** — before any dispatch, no exceptions
- **No hard timeouts** — background dispatch, let agent run
- **Use IPs** — MagicDNS broken in containers (`tailscale status` for IPs)
- **One task per PR** — same session continues until done

• Confidence: 82% confidence
• Finding: create dex task FIRST** — before any dispatch, no exceptions - **No hard timeouts** — background dispatch, let agent run - **Use IPs** — MagicDNS broken in containers (`tailscale status` for IPs) - **

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.