Security audit

Windows Remote

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Windows SSH administration skill, but it gives an agent broad remote command and file-transfer power with weak connection verification and limited user-control guidance.

Install only if you intentionally want an agent to administer a specific Windows host over SSH. Configure least-privilege SSH credentials, verify the host key instead of using StrictHostKeyChecking=no, narrow when the skill is invoked, and require explicit confirmation before uploads, downloads, service changes, or non-read-only commands.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script disables SSH host key verification with StrictHostKeyChecking=no, which allows connections to proceed without validating the remote server's identity. In a tool specifically intended for remote command execution on Windows hosts, this creates a realistic man-in-the-middle risk where an attacker could impersonate the target host, capture commands, or induce execution against an attacker-controlled system.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad enough to activate this skill for generic requests like 'execute on remote' or 'check GPU', which can cause the agent to select a remote-command capability in contexts where the user did not clearly intend Windows SSH access. Because this skill enables command execution on remote systems, accidental invocation meaningfully increases the risk of unintended system actions.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill prominently documents remote command execution, service control, script execution, and file transfer without user-facing safety constraints or warnings about system impact. In an agent setting, this can normalize powerful actions and increase the chance of destructive or unauthorized operations being performed without adequate confirmation.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The script silently defaults to using a local SSH private key file for authentication without disclosing that behavior to the caller. In an agent/automation context, implicit credential use is dangerous because it can trigger remote access with sensitive keys the user did not intend to expose or use, reducing transparency and auditability.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script performs direct remote shell execution of arbitrary user-supplied commands with no confirmation, safety prompt, allowlist, or contextual warning. In a skill whose purpose is executing commands on remote Windows systems, this increases the chance of destructive or unintended actions being issued to production hosts, especially if invoked indirectly by another agent or user.

Static analysis

No suspicious patterns detected.