Security audit

Windows Remote

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Windows SSH remote-control tool, but it gives broad command and file-transfer power while disabling SSH host verification.

Install only if you intentionally want an agent to execute arbitrary commands and transfer files on a configured Windows host. Use a dedicated least-privilege Windows account and SSH key, verify and pin the host key instead of accepting unknown hosts, and review commands and file paths before running them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/win-exec.sh:20
Finding: SSH Host Authenticity Verification Disabled for Remote Command Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/win-upload.sh:20
Finding: SCP Uploads Permit Unverified Remote Host Impersonation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/win-download.sh:20
Finding: SCP Downloads Permit File Substitution by an Unverified Remote Host
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description emphasizes remote Windows control via SSH, especially executing commands, running scripts, and checking GPU status. The supplied code does not execute commands or manage the remote machine; it specifically performs file download via SCP from the remote host to the local system. File retrieval is a distinct capability not mentioned in the description, so this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
"example": "Administrator" }, "WINDOWS_SSH_KEY": { "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)", "required": false, "default": "~/.ssh/id_ed25519" },

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
"example": "Administrator" }, "WINDOWS_SSH_KEY": { "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)", "required": false, "default": "~/.ssh/id_ed25519" },

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
| Issue | Solution | |-------|----------| | Connection refused | Check SSH service: `Get-Service sshd` | | Permission denied | Verify SSH key in `~/.ssh/authorized_keys` or `administrators_authorized_keys` | | Timeout | Check firewall rules, verify IP/port | | Command not found | Use full path or check PATH on Windows |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/win-download.sh (reported line 10)May include surrounding context.
sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}" PORT="${WINDOWS_SSH_PORT:-22}" USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}" KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}" TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}" if [ -z "$1" ] || [ -z "$2" ]; then

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/win-exec.sh (reported line 11)May include surrounding context.
sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}" PORT="${WINDOWS_SSH_PORT:-22}" USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}" KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}" TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}" if [ -z "$1" ] || [ -z "$2" ]; then

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/win-upload.sh (reported line 10)May include surrounding context.
sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}" PORT="${WINDOWS_SSH_PORT:-22}" USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}" KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}" TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}" if [ -z "$1" ] || [ -z "$2" ]; then

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough that the skill may activate on common requests like 'execute on remote' or 'Windows 命令' without sufficient user intent verification. Because this skill enables real remote command execution and file transfer, accidental invocation increases the risk of unintended actions against a remote host.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
## Security Notes - Use SSH keys instead of passwords - Keep private keys secure (chmod 600) - Consider using Tailscale for cross-network access

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script disables SSH host key verification with StrictHostKeyChecking=no, which allows connections to proceed without validating the server identity. In a remote administration/download skill, this enables man-in-the-middle interception or redirection to a malicious host, potentially resulting in theft or tampering of downloaded files and credentials exposure during connection setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script executes an arbitrary caller-supplied command on a remote Windows host with no validation, allowlist, or user confirmation. In the context of an agent skill, this creates a direct remote command execution primitive that can be abused by prompt injection, accidental misuse, or unsafe upstream inputs to run destructive commands on managed systems.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.