Security audit

SAPCONET SSH Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about using SSH templates, but its message script can turn message text into unintended remote shell commands.

Review and fix scripts/msg-sapconet.sh before using it with any untrusted or variable message text. Confirm SAPCONET_TARGET points to the intended host and account, and treat these scripts as templates rather than ready-to-run production workflows.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/msg-sapconet.sh:9
Finding: Remote Command Injection Through Unsafely Interpolated Message
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description partly matches the code in that it references SAPCONET SSH templates, bird reads, and Puppeteer-related activity. However, the actual script primarily performs SSH connectivity/identity checks against a specific default target and a remote environment check, not actual Puppeteer runs. It also does not implement any inbox messaging workflow mentioned in the description. Because the declared purpose includes workflows that are absent, and the code accesses a specific remote host capability not clearly represented in the description, this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline comments state this is a placeholder for an actual SAPCONET inbox command and discuss maintaining NO_REPLY discipline for automated messages, implying message delivery behavior. In reality, the code only opens an SSH session and runs a remote echo of a TODO string, so the documented intent of inbox messaging is not what the script currently does.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.