remote-ssh-bridge

• Outcome: Pass
• Latest audit: May 28, 2026, 10:24 AM
• Version:
  0.1.3

Overview

This skill is a small, disclosed SSH template bundle; its main risk is unsafe quoting in one user-run message script, not hidden or malicious behavior.

Install only if you intentionally want SSH templates that run commands on a remote machine. Set REMOTE_TARGET yourself, use a least-privileged SSH account, inspect and replace the TODO commands before use, and do not pass secrets or untrusted text to msg-sapconet.sh unless the script is changed to pass the message safely, such as via stdin or robust shell escaping.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script transmits user-supplied message content to a remote host over SSH without any user-facing disclosure, confirmation, or logging, which can cause unintended exfiltration of sensitive data entered as the message argument. In this skill context, the command is explicitly designed to bridge to a remote operator machine, so silent remote transmission is more dangerous because users may treat it as a local helper while it actually sends content off-host.

VirusTotal

62/62 vendors flagged this skill as clean.