ResmoteConsole

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:29 PM UTC
• Version: 1.0.0

Overview

This skill is a real remote-console helper, but it exposes a writable browser terminal and can launch an agent with permission checks disabled, so users should review it carefully before installing.

Install only if you intentionally want to expose a host terminal through a browser and can secure it yourself. Before use, remove the claude-bypass preset, add authentication and TLS or an authenticated proxy for ttyd, avoid public GatewayPorts exposure, restrict access by VPN/firewall or loopback-only forwarding, and verify that stop_console.py actually closes the SSH tunnel.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:12

Finding

Unauthenticated Writable Terminal Exposed Through an SSH Reverse Tunnel

Content

View full analysis

Vulnerability Details

File Location: config.json:12-15; scripts/start_console.py:78-103, 155-176; SKILL.md:213-217
Vulnerability Type: Unauthenticated remote terminal exposure over plaintext HTTP
Risk Level: Critical

Complete Code Snippet:

json

"ttyd": {
  "port": 7681,
  "path": "ttyd",
  "options": "-W -t fontSize=16"
}

python

if server.get('ssh_alias'):
    ssh_args = [
        'ssh',
        '-R', f'{ttyd_port}:127.0.0.1:{ttyd_port}',
        ssh_target,
        '-N',
        *([] if is_windows else ['-f']),
        '-o', 'ServerAliveInterval=30',
        '-o', 'ServerAliveCountMax=3',
        '-o', 'ExitOnForwardFailure=yes',
    ]
else:
    ssh_args = [
        'ssh',
        '-R', f'{ttyd_port}:127.0.0.1:{ttyd_port}',
        '-p', str(server['port']),
        f"{server['user']}@{server['host']}",
        '-N',
        *([] if is_windows else ['-f']),
        '-o', 'ServerAliveInterval=30',
        '-o', 'ServerAliveCountMax=3',
        '-o', 'ExitOnForwardFailure=yes',
    ]

python

ttyd_args = [ttyd_path, '-p', str(port)]

if options:
    import shlex
    ttyd_args.extend(shlex.split(options))

ttyd_args.extend(['--cwd', project_path])
ttyd_args.append(shell)
ttyd_args.extend(shell_args)
ttyd_args.append(command)

markdown

5. **Server configuration**: `GatewayPorts yes` and `AllowTcpForwarding yes`

Technical Analysis

The configured ttyd option -W enables writable terminal interaction. The generated ttyd command contains no authentication option and no TLS configuration. The application then creates an SSH reverse forward from the remote server port to the local ttyd listener.

The documentation directs users to enable GatewayPorts yes. Depending on the SSH server configuration, this can make the reverse-forwarded port listen on a non-loopback interface and become reachable by othe ...[truncated 1373 chars]

Remediation

View remediation

Remediation Suggestions

• Do not enable writable remote access without authentication. Configure ttyd with strong, unique credentials or a stronger identity-aware authentication proxy.
• Bind the reverse-forwarded endpoint to the SSH server's loopback interface and place access behind a VPN or authenticated reverse proxy.
• Avoid globally enabling GatewayPorts yes; use a narrowly scoped SSH configuration and firewall rule if remote exposure is explicitly required.
• Enable HTTPS with a trusted certificate, or terminate TLS at a properly secured reverse proxy.
• Generate high-entropy, single-session credentials and avoid storing them in source-controlled configuration.
• Restrict the SSH server firewall so only explicitly trusted source addresses can reach the forwarded port.
• Run the console under a dedicated, unprivileged operating-system account with access only to the intended project.
• Add validation that refuses to start writable ttyd unless authentication and an approved network-access control are configured.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.json:18

Finding

Remote AI Agent Can Be Started with All Permission Checks Disabled

Content

View full analysis

Vulnerability Details

File Location: config.json:18-28; SKILL.md:145-191
Vulnerability Type: Disabled execution authorization controls
Risk Level: Critical

Complete Code Snippet:

json

"commands": {
  "claude": "claude",
  "claude-bypass": "claude --dangerously-skip-permissions",
  "codex": "codex"
},
"projects": {
  "项目名": {
    "path": "/path/to/project",
    "command": "claude-bypass"
  }
}

Technical Analysis

The supplied command registry explicitly defines a Claude invocation using --dangerously-skip-permissions, and the supplied example project selects that command. This option removes the normal approval boundary intended to constrain tool use and command execution.

The documentation warns about the risk, but a warning does not provide a technical control. Because this command is exposed through a remotely accessible writable terminal, compromise of the terminal directly exposes an AI agent operating without its normal permission checks.

Attack Path

1. The user configures or retains a project whose command is claude-bypass.
2. The remote console starts that project and resolves the command to claude --dangerously-skip-permissions.
3. An attacker obtains access to the terminal, including through the unauthenticated exposure described separately.
4. The attacker supplies instructions that cause the agent to invoke tools, modify files, or run local commands.
5. The agent performs those operations without its normal permission confirmations.

Impact Assessment

The attacker can exercise the AI agent's available filesystem and command-execution capabilities under the launching user's account without the normal interactive authorization boundary. Potential impact includes source-code modification, destructive command execution, access to user-readable secrets, alteration of build or deployment artifacts, and use of locally available credentials. The oper ...[truncated 122 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the claude-bypass command from the distributed configuration and documentation.
• Reject commands containing --dangerously-skip-permissions during configuration validation.
• Require normal agent permission prompts for all remotely accessible sessions.
• If an exceptional bypass mode must exist, require explicit local confirmation for every launch and prevent selection solely through configuration or remote input.
• Run the agent in a sandbox or container with a read-only base filesystem, a narrowly mounted project directory, no host credentials, and restricted network access.
• Use an allowlist of approved executable names and arguments rather than accepting arbitrary command strings.
• Record security-relevant launches and command selections in an auditable log.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/start_console.py:59

Finding

Process Termination Is Not Scoped to Instances Created by the Skill

Content

View full analysis

Vulnerability Details

File Location: scripts/start_console.py:59-67; scripts/stop_console.py:49-59
Vulnerability Type: Overbroad process termination and denial of service
Risk Level: Medium

Complete Code Snippet:

python

def kill_ttyd():
    """Kill all ttyd processes."""
    for proc in psutil.process_iter(['pid', 'name']):
        try:
            if proc.info['name'] and 'ttyd' in proc.info['name'].lower():
                proc.kill()
                print(f"Killed existing ttyd (PID: {proc.info['pid']})")
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue

python

# Kill ttyd processes
for proc in psutil.process_iter(['pid', 'name']):
    try:
        if proc.info['name'] and 'ttyd' in proc.info['name'].lower():
            pid = proc.info['pid']
            proc.kill()
            result["ttyd_pids"].append(pid)
            result["ttyd_stopped"] = True
            print(f"  Killed ttyd (PID: {pid})")
    except (psutil.NoSuchProcess, psutil.AccessDenied):
        continue

Technical Analysis

Forced startup and normal shutdown enumerate every process visible through psutil and kill any process whose name contains the substring ttyd. The code does not verify that the process was created by this Skill, uses the configured port, has the expected command line, belongs to the current user, or matches a previously recorded PID and creation time.

Substring matching also increases the chance of false positives. When the Skill runs with sufficient permissions, unrelated terminal services can be terminated.

Attack Path

1. A legitimate user or service starts an unrelated ttyd process on the same host.
2. Another user invokes start_console.py --force or runs stop_console.py.
3. The script enumerates processes and matches the unrelated process by name.
4. The script calls proc.kill() without ownership validati ...[truncated 468 chars]

Remediation

View remediation

Remediation Suggestions

• Capture the PID returned when ttyd is launched and store it in a state file readable and writable only by the launching user.
• Store the process creation time alongside the PID to prevent PID-reuse errors.
• Before termination, verify the PID, creation time, executable path, expected command line, configured port, and process owner.
• Terminate only the exact process created by this Skill.
• Attempt graceful termination first, wait for a bounded period, and use forced termination only if necessary.
• Replace substring process-name matching with exact executable and instance validation.
• Refuse elevated execution unless it is demonstrably required.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/stop_console.py:63

Finding

Shutdown Logic Can Leave the SSH Reverse Tunnel Active

Content

View full analysis

Vulnerability Details

File Location: scripts/start_console.py:78-124; scripts/stop_console.py:63-80
Vulnerability Type: Incomplete lifecycle management of a remote-access channel
Risk Level: High

Complete Code Snippet:

python

if is_windows:
    subprocess.Popen(
        ssh_args,
        creationflags=subprocess.CREATE_NO_WINDOW,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL
    )
else:
    subprocess.Popen(
        ['nohup'] + ssh_args,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL
    )

python

# Kill SSH tunnel on the port
for conn in psutil.net_connections():
    if conn.laddr and conn.laddr.port == port:
        try:
            proc = psutil.Process(conn.pid)
            if 'ssh' in proc.name().lower():
                pid = conn.pid
                proc.kill()
                result["ssh_pids"].append(pid)
                result["ssh_tunnel_stopped"] = True
                print(f"  Killed SSH tunnel (PID: {pid})")
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue

if result["ssh_pids"]:
    print(f"  Closed SSH tunnel on port {port}")
else:
    print(f"  No SSH tunnel found on port {port}")

Technical Analysis

The SSH client is detached or backgrounded, but its process handle or PID is not persisted. The shutdown script later searches for a process with a local network address using the configured ttyd port.

With SSH reverse forwarding, the configured forwarded port is normally opened on the remote SSH server. The local SSH client generally has an outbound connection whose local endpoint uses an ephemeral port, not the remote forwarding port. Therefore, inspecting conn.laddr.port == port on the local host may not identify the SSH process responsible for the reverse tunnel.

The start function also returns success when tunnel verification fails, whi ...[truncated 1158 chars]

Remediation

View remediation

Remediation Suggestions

• Preserve the exact SSH PID and creation time in a protected runtime state file.
• Prefer a dedicated SSH control socket and close the session using ssh -S <socket> -O exit <target>.
• Do not use local-port inspection as the primary identity mechanism for a reverse-forwarding client.
• Verify the SSH executable path, command line, remote target, forwarding specification, owner, and creation time before termination.
• After shutdown, actively verify that the process exited and that the remote forwarding endpoint is no longer reachable.
• Return a nonzero status and a clear warning if tunnel closure cannot be confirmed.
• Retain the Popen handle when operating in the same process, and use a supervised child-process model where practical.
• Do not return success from startup when tunnel establishment cannot be verified.

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Third-Party Dependency Is Not Reproducibly or Integrity Pinned

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1; SKILL.md:28-32, 211-213
Vulnerability Type: Unbounded dependency resolution without integrity verification
Risk Level: Low

Complete Code Snippet:

text

psutil>=5.9.0

bash

pip install psutil

Technical Analysis

The dependency declaration permits any psutil release at or above version 5.9.0, and the documentation recommends installing the package without a version constraint or hash verification. Future installations can therefore resolve to a release that was not reviewed with this project.

No evidence of typosquatting, dependency confusion, or a currently malicious package was found. The risk is a lack of reproducibility and integrity control rather than evidence that psutil itself is malicious.

Attack Path

1. A user follows the installation instructions or installs from requirements.txt.
2. The package resolver selects the newest version satisfying the lower-bound constraint.
3. If a future release or distribution channel is compromised, the user downloads unreviewed content.
4. Package installation or subsequent import executes that content in the user's environment.

Impact Assessment

A compromised dependency could execute with the privileges of the user performing installation or running the Skill. That scope may include project files, user-readable credentials, network access, and process information. Under current evidence, this is a preventative supply-chain concern rather than a confirmed compromise.

Remediation

View remediation

Remediation Suggestions

• Pin psutil to an exact reviewed version.
• Generate and store cryptographic hashes for all permitted distributions.
• Install with pip install --require-hashes -r scripts/requirements.txt.
• Use a lock file produced by a controlled dependency-management process.
• Review and deliberately update pinned versions on a defined maintenance schedule.
• Install dependencies in an isolated virtual environment under a nonprivileged account.
• Use a trusted package index and apply organizational controls that prevent fallback to untrusted indexes.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill predefines and recommends a command mode that runs Claude with --dangerously-skip-permissions, explicitly disabling permission safeguards. In a remote-console context, this is especially dangerous because it combines browser-accessible terminal exposure with an agent mode that can execute sensitive actions without approval, greatly increasing the chance of destructive or unauthorized operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The configuration defines a command alias, 'claude-bypass', that invokes 'claude --dangerously-skip-permissions', explicitly disabling Claude's permission checks. In a remote-console skill, this is especially dangerous because it enables remote sessions to run with reduced safeguards, increasing the risk of unauthorized file/system actions or abuse if the console is exposed, misused, or accessed by the wrong party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes code-execution capabilities through documented shell and file operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens containment and reviewability, making it easier for an agent to invoke broader capabilities than intended when managing the remote console.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and trigger conditions are entirely Chinese-language, including the required activation phrases. This effectively requires Chinese input/use and does not offer any language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The user-facing operating guide, warnings, troubleshooting, and setup checklist are all presented in Chinese only. For a general-purpose remote console skill, this is a language policy issue unless users are given a language choice or the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script automatically creates a reverse SSH tunnel and then advertises an access URL, effectively exposing a remote console service over the network. There is no explicit enforcement of authentication, transport security for the final console endpoint, host allowlisting, or strong user confirmation about exposure, which increases the chance of unintended remote access to a local development shell.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_console.py (reported line 111)May include surrounding context.

python

try:
        # Start SSH in background
        if is_windows:
            subprocess.Popen(
                ssh_args,
                creationflags=subprocess.CREATE_NO_WINDOW,
                stdout=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_console.py (reported line 118)May include surrounding context.

python

stderr=subprocess.DEVNULL
            )
        else:
            subprocess.Popen(
                ['nohup'] + ssh_args,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code starts ttyd in the background and executes a config- or user-selected command inside an interactive shell, creating a remotely reachable command execution surface. In the context of a mobile/browser-accessible remote console skill, this is inherently more dangerous because compromise or misconfiguration can grant attackers direct terminal access to the host and project files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_console.py (reported line 184)May include surrounding context.

python

try:
        if platform.system() == 'Windows':
            subprocess.Popen(
                ttyd_args,
                creationflags=subprocess.CREATE_NO_WINDOW,
                stdout=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_console.py (reported line 192)May include surrounding context.

python

cwd=project_path
            )
        else:
            subprocess.Popen(
                ttyd_args,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_config.py (reported line 64)May include surrounding context.

python

f"{server['user']}@{server['host']}", 'echo', 'SSH_OK']

    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

if not check_ttyd_installed(ttyd_path):
        errors.append(f"ttyd not found at: {ttyd_path}")
        print("  Install: scoop install ttyd (Windows) or sudo apt install ttyd (Linux)")
    else:
        print("  ✅ ttyd found")

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/validate_config.py (reported line 139)May include surrounding context.

python

if not check_ttyd_installed(ttyd_path):
        errors.append(f"ttyd not found at: {ttyd_path}")
        print("  Install: scoop install ttyd (Windows) or sudo apt install ttyd (Linux)")
    else:
        print("  ✅ ttyd found")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest file contains a natural-language value using a specific locale/script ("项目名") with no indication that language choice is optional or that the configuration is intended only for a Chinese-language environment. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as psutil>=5.9.0 without an upper bound or exact pin, which makes builds non-reproducible and allows different environments to resolve to different versions over time. In a remote-console skill, this increases supply-chain and operational risk because a future compromised or breaking release could be pulled into a component used to manage remote access tooling.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

psutil>=5.9.0

Unverifiable Dependency: psutil has 2 known advisory(ies) (CVE-2019-18874 (Double Free in psutil); CVE-2019-18874 (psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs bec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.