Billy — SAPCONET SSH Bridge

• Verdict: Suspicious
• Confidence: High
• Analyzed: May 10, 2026, 4:37 PM
• Findings: 3
• Version: 0.1.0

Overview

The skill is a clear SSH bridge, but its message template can let specially crafted message text run unintended commands on the SAPCONET host.

Only install this if you trust the SAPCONET target and understand it will run SSH commands with your account. Avoid using the message script with untrusted text until it is changed to safely quote or pass messages without remote shell interpolation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

ConcernHigh Confidence

What this means

If an agent passes untrusted or crafted message text into this script, it could run commands on the SAPCONET host using the user's SSH privileges.

Why it was flagged

The script inserts the message directly into a shell command executed by ssh on the remote host. A message containing a single quote and shell separators can break out of the echo string and execute unintended remote commands.

Skill content

ssh "${SAPCONET_TARGET}" "echo 'TODO: send inbox message: ${MESSAGE}'"

Recommendation

Do not interpolate raw message text into a remote shell command. Pass the message over stdin or apply robust shell quoting, and require user review before sending automated messages.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

Running the scripts may connect as the configured SSH user and perform actions with that account's permissions.

Why it was flagged

The scripts default to an SSH target and will likely rely on the user's existing SSH credentials or agent to authenticate. This is expected for an SSH bridge, but it grants remote account authority when run.

Skill content

SAPCONET_TARGET="${SAPCONET_TARGET:-neill@100.110.24.44}"

Recommendation

Verify the target host and username before running, set SAPCONET_TARGET explicitly, and use a scoped SSH key or account where possible.

ASI04: Agentic Supply Chain Vulnerabilities

NoteMedium Confidence

What this means

Users have less context for verifying the skill's origin and may not realize it depends on local SSH tooling.

Why it was flagged

The registry context provides no upstream source or homepage, and the metadata does not declare the ssh runtime even though the included scripts invoke ssh. This is not malicious by itself, but it reduces provenance and runtime clarity.

Skill content

Source: unknown; Homepage: none; Required binaries (all must exist): none

Recommendation

Document the source, declare ssh as a required binary, and review the included scripts before use.