ClawHub
Back to skill

Security audit

Remote Desktop

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent remote-desktop helper, but several documented commands could expose credentials, disable server identity checks, or open remote-access services too broadly.

Review this skill before installing. It can be useful for remote desktop setup, but do not paste real passwords into command-line examples, avoid `/cert:ignore` except as a temporary verified diagnostic, restrict any firewall rule to trusted source IPs, and do not enable anonymous PulseAudio TCP access on reachable networks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:55
Finding

Remote Desktop Password Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:55-62
Vulnerability Type: Plaintext credential exposure through process arguments
Risk Level: High

Vulnerable Code:

bash
# xfreerdp (recommended)
xfreerdp /v:HOST /u:USER /p:PASS /size:1920x1080 /dynamic-resolution

# With SSH tunnel first
ssh -L 3389:localhost:3389 user@jumphost
xfreerdp /v:localhost /u:USER

The same unsafe pattern also appears in protocols.md:19-28:

bash
xfreerdp /v:HOST /u:USER /p:PASS \
  /size:1920x1080 \        # Resolution
  /dynamic-resolution \     # Auto-resize
  /clipboard \              # Enable clipboard
  /sound:sys:alsa \         # Audio
  /drive:share,/home/user \ # Share folder
  /sec:tls \                # Force TLS
  /cert:ignore              # Skip cert validation (use carefully)

Technical Analysis

Passing an RDP password through the /p:PASS argument places sensitive authentication material in the command line. Depending on the operating system and execution environment, the value may be exposed through:

  • Shell history files
  • Process-listing utilities
  • Process accounting and monitoring systems
  • Terminal transcripts
  • Automation, debugging, or audit logs
  • Parent processes that record invoked commands

This guidance conflicts with the project's stated policy that plaintext passwords must not be saved. Avoiding profile storage does not prevent credentials from being persisted in shell history or operational logs.

Attack Path

  1. A user substitutes a real password for PASS and runs the documented command.
  2. The command is recorded in shell history, process telemetry, or terminal logs.
  3. A local user, monitoring process, support operator, or compromised log collector reads the exposed argument.
  4. The attacker extracts the username, target host, and password.
  5. The attacker uses the credentials to authenticate to the RDP service or another service w ...[truncated 401 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove /p:PASS from all examples and allow xfreerdp to prompt interactively.
  • Recommend a platform credential manager or another protected credential-input mechanism where noninteractive operation is necessary.
  • Warn users not to place passwords in shell commands, scripts, host profiles, environment variables, or command history.
  • Review terminal, shell-history, and automation logs if the published example has already been used with real credentials.
  • Rotate any password that may have been entered through this command-line pattern.

T09 · Insecure Skill Coding Practices

Error
Location
protocols.md:19
Finding

RDP Certificate Validation Bypass Enables Server Impersonation

Content
View full analysis

Vulnerability Details

File Location: protocols.md:19-28
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code:

bash
xfreerdp /v:HOST /u:USER /p:PASS \
  /size:1920x1080 \        # Resolution
  /dynamic-resolution \     # Auto-resize
  /clipboard \              # Enable clipboard
  /sound:sys:alsa \         # Audio
  /drive:share,/home/user \ # Share folder
  /sec:tls \                # Force TLS
  /cert:ignore              # Skip cert validation (use carefully)

A directly executable troubleshooting variant appears at troubleshooting.md:67-76:

bash
# Try different security modes
xfreerdp /v:HOST /u:USER /sec:tls
xfreerdp /v:HOST /u:USER /sec:rdp
xfreerdp /v:HOST /u:USER /sec:nla /cert:ignore

# Check if another session active (Windows)
# Use /admin to take over console
xfreerdp /v:HOST /u:USER /admin

Technical Analysis

The /cert:ignore option disables the client’s validation of the RDP server certificate. Encryption without authenticated server identity does not prevent an active network attacker from presenting a fraudulent certificate and impersonating the intended server.

The option is included in routine examples without requiring independent fingerprint validation, limiting use to a controlled diagnostic session, or explaining how to install and trust the correct certificate.

Attack Path

  1. An attacker obtains an on-path position through a hostile wireless network, compromised router, DNS manipulation, ARP spoofing, or control of an intermediate network.
  2. The user connects to the target while using /cert:ignore.
  3. The attacker redirects the connection to an RDP endpoint under their control and presents an untrusted certificate.
  4. The client accepts the certificate because validation has been disabled.
  5. The user submits authentication material or interacts with the impersonated endpoint.
  6. The atta ...[truncated 409 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove /cert:ignore from normal connection and troubleshooting examples.
  • Deploy a certificate issued by a trusted internal or public certificate authority.
  • Where a private certificate is unavoidable, verify its fingerprint over an independent trusted channel before accepting it.
  • Document secure certificate import or pinning procedures instead of disabling validation.
  • If bypassing validation is absolutely necessary for diagnosis, make the exception temporary, explicitly warn about interception, and prohibit entering credentials until identity has been independently verified.

T09 · Insecure Skill Coding Practices

Error
Location
troubleshooting.md:24
Finding

Unrestricted Firewall Rules Can Publicly Expose RDP and VNC

Content
View full analysis

Vulnerability Details

File Location: troubleshooting.md:24-35
Vulnerability Type: Overly permissive network exposure
Risk Level: High

Vulnerable Code:

bash
# Start RDP (Windows)
# Enable via Settings > Remote Desktop

# Start VNC server
vncserver :1

# Open firewall
sudo ufw allow 3389/tcp   # RDP
sudo ufw allow 5901/tcp   # VNC :1

Technical Analysis

The documented ufw allow rules permit inbound connections to RDP and VNC from any source unless separate network controls apply. On an internet-facing or otherwise untrusted network interface, these commands can expose remote-control services globally.

This contradicts the project's security guidance in SKILL.md:47-51, which states that RDP and VNC should not be exposed directly to the internet and recommends SSH tunnels, VPNs, or restricted firewall rules. VNC is particularly sensitive because its native security protections may be weak.

Attack Path

  1. A user experiencing a connection problem runs the unrestricted firewall commands on a host reachable from an untrusted network.
  2. TCP ports 3389 or 5901 become reachable from all source addresses.
  3. An attacker identifies the service through routine network scanning.
  4. The attacker performs password spraying, brute-force authentication, credential reuse, protocol downgrade attempts, or exploitation of a vulnerable RDP/VNC implementation.
  5. If successful, the attacker obtains an interactive remote session on the target.

Impact Assessment

The rules expand the network attack surface and may expose full remote-control services. Successful compromise can grant the privileges of the authenticated remote account, including desktop interaction, access to files and applications, and potentially administrative control. Exposure can affect any interface governed by the unrestricted firewall rule.

Remediation
View remediation

Remediation Suggestions

  • Prefer an SSH tunnel or authenticated VPN and avoid opening RDP or VNC ports directly.

  • If a firewall exception is necessary, restrict it to a specific trusted source address or subnet, for example:

    bash
    sudo ufw allow from TRUSTED_CIDR to any port 3389 proto tcp

  • Bind the remote-desktop service to a loopback or private interface where supported.

  • Require strong authentication, account lockout or rate limiting, and current patched server software.

  • Document how to remove temporary rules after troubleshooting.

  • Require explicit user confirmation before any firewall modification and verify whether the host has an internet-facing interface.

T09 · Insecure Skill Coding Practices

Error
Location
troubleshooting.md:164
Finding

Anonymous PulseAudio TCP Service Exposes Audio Resources

Content
View full analysis

Vulnerability Details

File Location: troubleshooting.md:164-182
Vulnerability Type: Missing authentication on a network-accessible service
Risk Level: High

Vulnerable Code:

bash
## Audio Not Working

**RDP:**
```bash
# ALSA
xfreerdp /v:HOST /u:USER /sound:sys:alsa

# PulseAudio
xfreerdp /v:HOST /u:USER /sound:sys:pulse

VNC: VNC doesn't support audio natively. Use PulseAudio network streaming:

bash
# On server
pactl load-module module-native-protocol-tcp auth-anonymous=1

# On client
PULSE_SERVER=tcp:HOST:4713 firefox
text

### Technical Analysis

Loading `module-native-protocol-tcp` with `auth-anonymous=1` explicitly allows clients to connect without authentication. The instructions do not limit the listening interface, constrain client addresses, require a firewall restriction, or tunnel the traffic through an authenticated encrypted channel.

If TCP port 4713 is reachable by other hosts, an unauthorized client may interact with the PulseAudio server. The exact operations available depend on the PulseAudio configuration and version, but exposing the native protocol anonymously creates a direct trust-boundary violation involving audio streams and devices.

### Attack Path

1. A user runs the documented `pactl` command on the remote server.
2. PulseAudio begins accepting native-protocol TCP connections without client authentication.
3. An attacker with network reachability discovers or directly contacts TCP port 4713.
4. The attacker connects without possessing an authentication cookie.
5. Subject to server policy, the attacker accesses, injects, redirects, records, or disrupts audio streams and devices.

### Impact Assessment

Potential impact includes audio eavesdropping, unauthorized audio playback or injection, disruption of legitimate streams, and disclosure of private communications or environmental audio. Access is generally bounded by the privileges an
...[truncated 124 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove auth-anonymous=1 from the recommendation.
  • Use PulseAudio cookie authentication and explicitly restrict allowed client addresses.
  • Bind the service only to a trusted loopback or private interface.
  • Prefer forwarding the audio connection through an authenticated SSH tunnel rather than exposing port 4713.
  • Add host-firewall restrictions that permit only the intended client.
  • Provide instructions to unload the module after use and verify that port 4713 is no longer listening.

T08 · Insecure Dependencies

Warning
Location
protocols.md:135
Finding

Unpinned RustDesk Container Image Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: protocols.md:135-145
Vulnerability Type: Mutable and unverified third-party container dependency
Risk Level: Medium

Vulnerable Code:

bash
### RustDesk (Self-Hosted)

```bash
# Server setup
docker run -d --name rustdesk-server \
  -p 21115:21115 -p 21116:21116 -p 21117:21117 \
  -p 21118:21118 -p 21119:21119 \
  rustdesk/rustdesk-server

# Client connects via ID
text

### Technical Analysis

The image reference `rustdesk/rustdesk-server` has neither an explicit version tag nor an immutable digest. Docker therefore resolves a mutable default tag, normally `latest`, whose contents may change after the Skill has been reviewed.

The command executes the downloaded image and publishes five container ports on host interfaces. If the upstream account, registry, image-building pipeline, or mutable tag is compromised, subsequently executed code can differ from the code originally assessed.

This is a supply-chain weakness rather than evidence that the named RustDesk image is currently malicious.

### Attack Path

1. The upstream registry account, build pipeline, or mutable image tag is compromised or changed unexpectedly.
2. A user follows the documentation and runs the unpinned `docker run` command.
3. Docker retrieves the current image associated with the mutable default tag.
4. The attacker-controlled or unexpectedly changed container code executes on the host.
5. The container accesses resources available under its runtime permissions and exposes the published services to reachable networks.

### Impact Assessment

Impact depends on the Docker daemon, container configuration, and vulnerabilities available for container escape. At minimum, a compromised image controls the container environment and its network services. It may access mounted or runtime-provided resources and attack adjacent systems. In a worst-case scenario involving excessive daemon p
...[truncated 87 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the image to a reviewed release and immutable SHA-256 digest, for example:

    bash
    docker run ... rustdesk/rustdesk-server:REVIEWED_VERSION@sha256:VERIFIED_DIGEST

  • Verify the image publisher, signature, provenance, and software bill of materials before use.

  • Introduce a controlled update process that reviews and updates the digest deliberately.

  • Run the container with least privilege, including a read-only filesystem, dropped Linux capabilities, resource limits, and a non-root user where supported.

  • Publish only required ports and bind them to the intended trusted interface rather than all host interfaces.

  • Scan the pinned image for known vulnerabilities before deployment.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 15)May include surrounding context.

md
integration: pending

## Context
<!-- What you know about their setup -->
<!-- Client OS, common targets, network situation -->

## Preferences

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 19)May include surrounding context.

md
<!-- Client OS, common targets, network situation -->

## Preferences
<!-- How they like to connect -->
<!-- Default protocol, resolution, tunnel preference -->

## Saved Hosts

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · setup.md (reported line 49)May include surrounding context.

md
**Ask before saving configs.** When a connection works, offer to save it: "Want me to save this config for next time?" Never save passwords.

**Be practical.** If they just want to connect fast, give the command. Don't lecture about security unless they're doing something dangerous.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The recommendation to use /cert:ignore disables RDP certificate validation, allowing connections without authenticating the server identity. This materially increases man-in-the-middle risk, especially in exactly the kind of remote/networked scenarios this skill addresses.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Anonymous PulseAudio network access exposes local audio streams to unauthenticated remote clients, which can leak sensitive information or permit unauthorized use. The lack of any privacy or access-control warning makes the advice unsafe for routine troubleshooting.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
| Headless Linux | SSH + X11 forwarding | No desktop needed |

### 2. Security First
- Always prefer SSH tunneling over direct exposure
- Never expose RDP (3389) or VNC (5900) to internet directly
- Use SSH keys, not passwords
- If direct needed, use VPN or firewall rules

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
**This skill does NOT:**
- Store passwords in plain text — use SSH keys or system keyring
- Auto-save configs without asking first
- Connect to hosts without explicit user command
- Make any network requests itself (you run the commands)
- Access any memory outside `~/remote-desktop/`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The xfreerdp example includes /cert:ignore, which disables certificate validation and makes users vulnerable to man-in-the-middle attacks against remote desktop sessions. In a remote access skill, this is more dangerous than in generic networking documentation because it directly trains users to bypass authentication protections on sensitive administrative connections.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 20)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 21)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 33)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 34)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 89)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · troubleshooting.md (reported line 111)May include surrounding context.

ss -tlnp | grep 22 # SSH

Check firewall (on target)

sudo ufw status sudo iptables -L -n | grep 3389

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions open RDP and VNC firewall ports directly without any warning that these services become reachable from other networks depending on host firewall scope and network placement. Exposing remote desktop services increases attack surface and can enable brute force, credential theft attempts, or exploitation of service flaws.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Restarting sshd during remote troubleshooting can terminate or disrupt active SSH sessions, potentially locking out the operator from the system. While not a classic exploit primitive, omitting this warning creates availability risk in a remote access skill where loss of access is especially consequential.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance loads PulseAudio's TCP module with auth-anonymous=1, which exposes remote audio access to anyone who can reach the port. In a remote desktop troubleshooting context this is unnecessary and can allow unauthorized listening or audio injection, creating privacy and lateral-access risks.

Content

No source excerpt is available for this finding.