MCP SSH Manager

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:29 AM UTC
• Version: 0.1.1

Overview

The skill appears to be a legitimate SSH management helper, but it needs review because it can drive broad remote administration and its examples understate risks around destructive commands and saved server data.

Install only if you intend to let an agent administer trusted SSH hosts. Use least-privilege SSH accounts, review every command before execution, require explicit approval for sudo, sync, restore, tunnel, service restart, session-close-all, and deletion operations, and treat all saved ~/.ssh-workdir outputs as sensitive data that should be protected, redacted, and cleaned up.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill clearly instructs use of shell-like command execution and local filesystem operations, yet it declares no permissions or safety boundaries. This can cause downstream systems or users to underestimate the skill's ability to execute commands and manipulate files, increasing the chance of unsafe invocation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill documents high-impact operations such as remote command execution, uploads/downloads, tunnel creation, backup, and restore without requiring warnings, confirmations, or safety checks. In an agent setting, this makes accidental destructive changes, data exposure, or unauthorized access more likely because the skill normalizes powerful actions as routine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The deployment and restore examples include overwriting files under /var/www, extracting archives, restarting services, and backup restoration with no warning about service interruption, data loss, or rollback requirements. These examples can be copied directly into production-like environments and lead to destructive outcomes if used without validation.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documented deployment and rollback workflow includes clearly destructive operations such as stopping/deleting services and later removing application files, but it does not present an explicit warning or confirmation gate about downtime, rollback risk, or possible data loss. In an SSH management skill, operators may copy these steps directly, so omission of safety warnings increases the chance of accidental production disruption.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example explicitly saves outputs from commands such as `netstat -tulpn`, `ss -tulpn`, `docker ps -a`, `who`, and `last`, which can expose listening services, process associations, container names, logged-in users, and login history. Persisting this data under a reusable workdir without any warning, minimization guidance, or access-control guidance increases the chance of local disclosure, accidental sharing, or long-term retention of sensitive operational metadata.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The summary recommends `docker image prune -a` and `docker container prune` as cleanup actions without warning that they remove unused images and stopped containers, which can disrupt rollback, debugging, or later redeployment workflows. In an SSH management skill, operators may copy these recommendations directly onto production systems, making unintended destructive maintenance more likely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This workflow performs privileged state-changing actions on a live server, including changing socket ownership/permissions and restarting services, but does not warn the operator about outage risk, security tradeoffs, or the need to validate before execution. In an SSH-management skill, omission of such guardrails can lead to unsafe copy-paste execution and service disruption, especially because one suggested fix uses overly permissive access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The permanent-fix section edits a live PHP-FPM configuration in place with `sudo sed -i` and immediately restarts the service, but provides no backup, validation, or warning about possible syntax errors and downtime. In a remote administration skill, this is materially risky because a malformed replacement or environment-specific config difference can break service availability across the host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples include system-altering remote operations such as package installation, service restart, and deployment steps without any cautionary language, confirmation guidance, or scope restrictions. In an SSH management skill, users may copy these commands directly onto production systems, increasing the chance of unintended service disruption or configuration drift.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation presents `ssh_session_close session="all"` as a simple option without warning that it will terminate every active session, which can interrupt deployments, monitoring, or administrative work. In a session-management tool, this is operationally dangerous because the command has broad blast radius and could be invoked accidentally or copied without understanding the consequence.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The server-configuration section instructs users to modify `sshd_config` and reload `sshd` without emphasizing that this changes remote access behavior and could affect active or future SSH connectivity if misconfigured. Although this is standard administration guidance, omitting review and rollback cautions makes accidental lockout or service disruption more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document encourages persistent storage of SSH command outputs, host status snapshots, and troubleshooting artifacts under a local workdir, but it does not warn that these files can contain sensitive operational data such as hostnames, service inventories, log excerpts, network state, and potentially secrets. In an SSH-management skill, this is more dangerous because the captured data is likely to come from production systems and may accumulate over time, increasing exposure if the local machine or home directory is accessed by other users, backups, or malware.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples save remote command output and log data such as syslog errors, netstat results, service listings, and health-check snapshots directly into local files without any privacy or security warning. In the context of a remote server management skill, these artifacts can reveal infrastructure details, usernames, internal network exposure, failure events, and other sensitive telemetry that could aid lateral movement or reconnaissance if stored insecurely or shared broadly.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill encourages persistent logging of all SSH commands, outputs, summaries, and historical comparisons in a predictable local directory. SSH outputs often contain secrets, internal topology, usernames, hostnames, logs, and operational details, so retaining them by default increases the risk of sensitive data exposure and later misuse.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

|------|------|---------|
| List servers | `ssh_list_servers` | `ssh_list_servers` |
| Execute command | `ssh_execute` | `ssh_execute server="rock5t" command="df -h"` |
| Execute with sudo | `ssh_execute_sudo` | `ssh_execute_sudo server="rock5t" command="apt update"` |
| Check status | `ssh_connection_status` | `ssh_connection_status action="status"` |

### Session Management

• Confidence: 78% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

|------|------|---------|
| List servers | `ssh_list_servers` | `ssh_list_servers` |
| Execute command | `ssh_execute` | `ssh_execute server="rock5t" command="df -h"` |
| Execute with sudo | `ssh_execute_sudo` | `ssh_execute_sudo server="rock5t" command="apt update"` |
| Check status | `ssh_connection_status` | `ssh_connection_status action="status"` |

### Session Management

• Confidence: 78% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ssh_session_send session="sess-xxx" command="sudo chmod 666 /run/php/php8.2-fpm.sock"

# Restart services
ssh_session_send session="sess-xxx" command="sudo systemctl restart php8.2-fpm"
ssh_session_send session="sess-xxx" command="sudo systemctl restart nginx"

# Verify both are running

• Confidence: 98% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Expected output shows missing/broken settings

# Update config
ssh_execute server="rock-5t" command="sudo sed -i 's/^listen = \/run\/php\/php8.2-fpm.sock/listen = \/run\/php\/php8.2-fpm.sock\nlisten.owner = www-data\nlisten.group = www-data\nlisten.mode = 0660/' /etc/php/8.2/fpm/pool.d/www.conf"

# Restart PHP-FPM
ssh_execute server="rock-5t" command="sudo systemctl restart php8.2-fpm"

• Confidence: 88% confidence
• Finding: sudo

Chaining Abuse

High

• Category: Tool Misuse

Content

ssh_session_start server="rock-5t" name="rollback-2026-02-07"

# Restore backup
ssh_session_send session="sess-xxx" command="cd /home/imax/app && rm -rf *"
ssh_session_send session="sess-xxx" command="cd /home/imax/app && tar -xzf ~/.ssh-workdir/rock-5t/2026-02-07-deployment/rollback/backup-20260207.tar.gz"

# Restart service

• Confidence: 95% confidence
• Finding: && rm -

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.