T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:58- Finding
RDP Password Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Remote Desktop
Security checks for vulnerabilities and agentic risk
Overview
This remote desktop skill is coherent and not deceptive, but several examples could expose credentials or remote-access services if followed as written.
Review before installing. The skill is not an auto-executing payload, but users should avoid putting passwords in commands, avoid /cert:ignore and legacy RDP security except in isolated tests, keep RDP/VNC behind SSH tunnels or VPNs, restrict firewall rules to trusted sources, and not enable anonymous PulseAudio TCP on reachable networks.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
protocols.md:27- Finding
RDP Certificate Validation Can Be Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
troubleshooting.md:68- Finding
Legacy RDP Security Downgrade Recommended as a Troubleshooting Step
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
troubleshooting.md:175- Finding
Unauthenticated PulseAudio TCP Service Exposed for Audio Forwarding
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
troubleshooting.md:31- Finding
Unrestricted Firewall Rules Expose RDP and VNC Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md integration: pending ## Context <!-- What you know about their setup --> <!-- Client OS, common targets, network situation --> ## Preferences
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- Client OS, common targets, network situation --> ## Preferences <!-- How they like to connect --> <!-- Default protocol, resolution, tunnel preference --> ## Saved Hosts
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md **Ask before saving configs.** When a connection works, offer to save it: "Want me to save this config for next time?" Never save passwords. **Be practical.** If they just want to connect fast, give the command. Don't lecture about security unless they're doing something dangerous.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide recommends using xfreerdp with /cert:ignore, which disables certificate validation and makes man-in-the-middle or host impersonation attacks much easier. Because this skill is specifically about remote desktop access over potentially untrusted networks, normalizing insecure fallback settings is especially dangerous.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The PulseAudio example enables
module-native-protocol-tcpwithauth-anonymous=1, which allows unauthenticated network audio access. That can expose microphone/speaker streams, permit unauthorized eavesdropping or audio injection, and expand the attack surface on the host.- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md | Headless Linux | SSH + X11 forwarding | No desktop needed | ### 2. Security First - Always prefer SSH tunneling over direct exposure - Never expose RDP (3389) or VNC (5900) to internet directly - Use SSH keys, not passwords - If direct needed, use VPN or firewall rules
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **This skill does NOT:** - Store passwords in plain text — use SSH keys or system keyring - Auto-save configs without asking first - Connect to hosts without explicit user command - Make any network requests itself (you run the commands) - Access any memory outside `~/remote-desktop/`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template directs creation of local memory files that store sensitive infrastructure details such as hostnames, internal IPs, usernames, protocols, ports, and SSH tunnel commands. Even if intended for convenience, this creates a persistent inventory of remote-access information without any warning, minimization guidance, access controls, or consent language, increasing the risk of credential-adjacent leakage and lateral movement if the workstation or home directory is exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The
xfreerdpexample includes/p:PASSdirectly on the command line, which can expose credentials through shell history, process listings, terminal logging, or monitoring tools. In a remote desktop administration guide, this is especially risky because it trains users to handle privileged access credentials insecurely.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Recommending
/cert:ignorewith only a mild 'use carefully' note normalizes disabling certificate validation, which defeats server identity verification and enables man-in-the-middle interception. In the context of remote desktop connections, this could expose credentials, session contents, and shared clipboard or drive data to an attacker.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The Docker example pulls and runs
rustdesk/rustdesk-serverwithout a version tag or digest, so users may execute whatever image the registry serves at that moment. This creates supply-chain and reproducibility risk, especially for remote access infrastructure where a compromised or changed image could expose sensitive systems.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ss -tlnp | grep 22 # SSH
Check firewall (on target)
sudo ufw status sudo iptables -L -n | grep 3389
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The troubleshooting guide instructs users to open RDP and VNC firewall ports directly but does not warn that this exposes remote access services to the network and potentially the internet. In the context of a remote desktop skill, that omission is meaningful because these services are high-value attack targets and should not be exposed broadly without access restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Restarting sshd after configuration changes can terminate or disrupt active remote sessions, potentially locking out administrators if the new configuration is invalid or if they are connected only through SSH. While not an exploit primitive by itself, omitting that operational risk in remote administration guidance can cause availability and access loss.
- Content
Static analysis
No suspicious patterns detected.