huawei-cloud-ascend-remote-connect

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:36 PM UTC
• Version: 1.0.0

Overview

This is a powerful SSH administration skill with broad remote command authority, weak execution guardrails, and credential/host-verification risks that users should review carefully before installing.

Install only if you intentionally want a broad SSH administration tool, not just a narrow Ascend monitor. Use a dedicated non-root account with tightly scoped sudo, prefer SSH keys, avoid passing passwords on the command line, verify host keys, disable or restrict raw/direct command execution, and test on non-production hosts before allowing access to important systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        cmd = ['ssh'] + ssh_opts + [f'{user}@{host}', 'true']

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
    if result.returncode != 0:
        return None

• Confidence: 94% confidence
• Finding: The code invokes sshpass with the password supplied on the command line (`sshpass -p <password>`), which exposes credentials to local process inspection mechanisms such as `ps`, `/proc`, audit logs, or other monitoring on the machine running the skill. In a remote-connect skill handling privileged infrastructure access, this directly undermines the claim that passwords remain only in memory and can leak root credentials to other local users or logging systems.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Raw mode: execute directly, bypass NL routing
    if raw:
        result = subprocess.run(
            ['ssh', '-o', f'ControlPath={ctrl_path}', '-o', 'ControlMaster=auto',
             '-o', 'BatchMode=yes', '-p', str(port), f'{user}@{host}', command],
            capture_output=True, text=True, timeout=60

• Confidence: 96% confidence
• Finding: This code performs raw remote command execution in one-shot mode with no confirmation, policy enforcement, or command restrictions. Because this skill is explicitly designed for remote SSH access to Ascend servers and may default to privileged accounts, a prompt-influenced or mistaken invocation can immediately run destructive commands on production infrastructure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return 0
    else:
        # Direct shell command goes through fast mode
        result = subprocess.run(
            ['ssh', '-o', f'ControlPath={ctrl_path}', '-o', 'ControlMaster=auto',
             '-o', 'BatchMode=yes', '-p', str(port), f'{user}@{host}', command],
            capture_output=True, text=True, timeout=60

• Confidence: 96% confidence
• Finding: Direct shell-like commands are routed straight to remote SSH execution based on a heuristic classifier, bypassing the advertised sensitive-operation guardrails. Misclassification or deliberate phrasing can therefore execute impactful administrative commands immediately on remote systems, which is particularly dangerous in a skill meant to manage disks, containers, and NPUs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares only allowed tools but no explicit permission model despite clearly enabling shell, SSH, and network-driven remote execution. In a skill that can connect to arbitrary hosts and run commands, missing or underspecified permissions increases the chance of unintended invocation, overbroad trust, and unsafe execution without adequate policy gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose presents this as a constrained Ascend-support skill, but the behavior described is effectively a general-purpose remote administration shell for arbitrary hosts. That mismatch is dangerous because users, reviewers, or enforcement systems may authorize the skill under a narrower trust model while it can perform far broader actions including package installation, firewall changes, account operations, and raw command execution that may bypass intended safety routing.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The validator uses a default-allow model: after checking a small set of blocked and sensitive regexes, any command not matching those lists is returned as ALLOWED. In a remote SSH skill that can execute arbitrary shell commands on Ascend servers, this creates a substantial bypass surface because dangerous commands, shell metacharacter compositions, and destructive variants not explicitly enumerated will be permitted.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file-operation module provides broad arbitrary file read/write/delete/copy/move/chmod capabilities that go beyond the skill’s stated scope of remote connection, monitoring, disk/LVM, container management, security auditing, and log analysis. In a remote SSH skill, these primitives materially expand operator power and can be abused to destroy data, alter system state, or access sensitive files on any connected host.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: After connection, the executor falls back to running arbitrary user-supplied shell commands directly on the remote host. This defeats the idea of a purpose-limited operational skill and turns it into a general remote shell, enabling unrestricted execution, data access, service disruption, persistence, or privilege misuse depending on the remote account.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The success message implies the available commands are limited to listed natural-language tasks, but the implementation also allows arbitrary direct Linux commands. This is a deceptive capability mismatch that can mislead users and reviewers about the real power of the skill, reducing informed consent and increasing the chance of unsafe use.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The help text states that passwords are only stored in memory, but the implementation places them into spawned command arguments via sshpass, where they may be visible to other local users, logs, or monitoring tools. This is a security-relevant misleading claim because users may supply sensitive cloud credentials under false assumptions about exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example sudoers entry grants the named user unrestricted passwordless root access via `NOPASSWD: ALL`. In a skill centered on remote SSH access to cloud devices, documenting this as a minimum privilege pattern materially increases the blast radius of any compromised session, credential theft, or prompt/tool misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to modify /etc/ssh/sshd_config in place and immediately restart sshd without warning that this can lock out remote access, weaken authentication policy, or disrupt active sessions. In the context of a remote-connect skill, suggesting enabling password authentication is especially risky because it reduces SSH hardening and encourages changing security-critical settings during troubleshooting.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The verification guide uses broad natural-language prompts like 'Check CPU and memory' and 'Delete /tmp/test.txt' after establishing a remote SSH session, without tightly constraining what commands the skill may infer or execute. In a skill specifically designed for remote command execution on Ascend servers, ambiguous admin-style phrasing increases the chance of unintended or overbroad action, especially if the parser maps generic requests to privileged shell commands.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The environment-variable action exposes process and session environment data without any special warning, even though environment variables often contain secrets such as API tokens, cloud credentials, proxy credentials, and internal endpoints. On a remote admin host, silent disclosure of env can leak high-value credentials far beyond simple system monitoring.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SSH key audit action reads and returns authorized_keys content for root and user accounts without a prominent warning. Although framed as security auditing, this exposes trust relationships and public key material that can reveal account access configuration and facilitate follow-on targeting or persistence planning.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The key-generation flow creates a new root SSH keypair and immediately discloses the public key, but the warning does not explain that this establishes new remote access material and may alter the host’s trust posture. In an SSH administration context, creating authentication artifacts is a sensitive security operation that warrants stronger disclosure and tighter control.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Disabling SSH host key verification (`StrictHostKeyChecking=no` and `UserKnownHostsFile=/dev/null`) defeats server authenticity checks and enables man-in-the-middle attacks. An attacker controlling network position or DNS/routing could intercept credentials and execute commands on behalf of the user, which is severe for a tool intended to access privileged cloud servers.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The raw one-shot execution path explicitly bypasses natural-language routing and any potential confirmation workflow, allowing arbitrary remote command execution with a single flag. In the context of an SSH administration skill, this greatly increases the chance of destructive or unintended actions and weakens the stated security model.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Paramiko fallback raw execution path bypasses the higher-level executor’s safety logic and runs arbitrary remote commands directly after accepting any host key via `AutoAddPolicy`. Combined with password authentication, this creates a high-risk path for both unintended destructive actions and interception by malicious hosts.

Credential Access

High

• Category: Privilege Escalation

Content

elif action == 'ssh_config':
                    return self._exec_simple('SSH config', 'grep -v "^#" /etc/ssh/sshd_config 2>/dev/null | grep -v "^$"')
                elif action == 'ssh_keys':
                    return self._exec_simple('SSH keys', 'echo "=== root authorized_keys ==="; cat /root/.ssh/authorized_keys 2>/dev/null || echo "none"; for user in $(ls /home/ 2>/dev/null | head -5); do echo; echo "=== $user ==="; cat /home/$user/.ssh/authorized_keys 2>/dev/null || echo "none"; done')
                elif action == 'security_check':
                    return self._exec_simple('security check', 'echo "=== open ports ==="; ss -tlnp 2>/dev/null | head -20; echo; echo "=== firewall ==="; iptables -L -n 2>/dev/null | head -10 || echo "none"; echo; echo "=== SSH config ==="; grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config 2>/dev/null; echo; echo "=== failed logins (recent 5) ==="; lastb -10 2>/dev/null | head -5 || echo "none"')
                elif action == 'system_users':

• Confidence: 95% confidence
• Finding: This duplicate finding points to the same authorized_keys enumeration behavior, which exposes authentication trust configuration across accounts. In a general-purpose remote-connect skill, that is sensitive credential-adjacent information and should not be retrievable by default without heightened disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

elif action == 'ssh_config':
                    return self._exec_simple('SSH config', 'grep -v "^#" /etc/ssh/sshd_config 2>/dev/null | grep -v "^$"')
                elif action == 'ssh_keys':
                    return self._exec_simple('SSH keys', 'echo "=== root authorized_keys ==="; cat /root/.ssh/authorized_keys 2>/dev/null || echo "none"; for user in $(ls /home/ 2>/dev/null | head -5); do echo; echo "=== $user ==="; cat /home/$user/.ssh/authorized_keys 2>/dev/null || echo "none"; done')
                elif action == 'security_check':
                    return self._exec_simple('security check', 'echo "=== open ports ==="; ss -tlnp 2>/dev/null | head -20; echo; echo "=== firewall ==="; iptables -L -n 2>/dev/null | head -10 || echo "none"; echo; echo "=== SSH config ==="; grep -E "^(PermitRootLogin|PasswordAuthentication|Port)" /etc/ssh/sshd_config 2>/dev/null; echo; echo "=== failed logins (recent 5) ==="; lastb -10 2>/dev/null | head -5 || echo "none"')
                elif action == 'system_users':

• Confidence: 95% confidence
• Finding: This duplicate finding points to the same authorized_keys enumeration behavior, which exposes authentication trust configuration across accounts. In a general-purpose remote-connect skill, that is sensitive credential-adjacent information and should not be retrievable by default without heightened disclosure.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `mkfs` - Format operations
- `umount` - Unmount operations
- `reboot`, `shutdown` - System restart/shutdown
- `docker rm`, `docker rmi` - Container/image removal

### Blocked Commands (Always blocked)
- Fork bomb patterns

• Confidence: 88% confidence
• Finding: The document explicitly permits dangerous destructive commands such as `rm`, `mkfs`, `umount`, `reboot`, and Docker removal actions after confirmation. In a remote-connection skill, confirmation-only gating is weak because user prompts can be socially engineered, misinterpreted, or triggered with unsafe parameters, leading to data loss, denial of service, or environment destruction.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/verification-method.md:25

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:145