Remote Desktop

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:14 PM UTC
• Version: 1.0.0

Overview

This remote desktop skill is coherent and not deceptive, but several examples could expose credentials or remote-access services if followed as written.

Review before installing. The skill is not an auto-executing payload, but users should avoid putting passwords in commands, avoid /cert:ignore and legacy RDP security except in isolated tests, keep RDP/VNC behind SSH tunnels or VPNs, restrict firewall rules to trusted sources, and not enable anonymous PulseAudio TCP on reachable networks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58
• Finding: RDP Password Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58` and `protocols.md:20-27` **Vulnerability Type**: Plaintext credential exposure through process arguments **Risk Level**: High ### Vulnerable Code `SKILL.md:58`: ```bash xfreerdp /v:HOST /u:USER /p:PASS /size:1920x1080 /dynamic-resolution ``` `protocols.md:20-27`: ```bash xfreerdp /v:HOST /u:USER /p:PASS \ /size:1920x1080 \ # Resolution /dynamic-resolution \ # Auto-resize /clipboard \ # Enable clipboard /sound:sys:alsa \ # Audio /drive:share,/home/user \ # Share folder /sec:tls \ # Force TLS /cert:ignore # Skip cert validation (use carefully) ``` ### Technical Analysis The examples instruct users to replace `PASS` with an RDP password supplied through the `/p:` command-line argument. A real password entered this way can be exposed through shell history, process listings, command auditing, terminal recordings, diagnostic reports, and process-monitoring systems. This also conflicts with the skill's stated policy that plaintext passwords should not be saved. Although the skill does not itself persist the password in a profile, placing it directly in a shell command can cause the shell or operating system to persist or disclose it indirectly. ### Attack Path 1. A user follows the documented example and replaces `PASS` with a real account password. 2. The complete command is recorded in shell history or becomes temporarily visible in process metadata. 3. Another local user, administrator, monitoring agent, support bundle, or log collector reads the command. 4. The exposed credentials are used to authenticate to the associated RDP host. 5. The attacker receives whatever remote privileges are assigned to the compromised account. ### Impact Assessment Successful exploitation discloses the remote desktop account password. The resulting access scope is determined by the compromised account and may range from an ordinary W ...[truncated 137 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `/p:PASS` from every example. - Allow `xfreerdp` to request the password interactively. - Where noninteractive authentication is required, use an approved operating-system credential manager rather than command-line arguments. - Explicitly warn users not to place credentials in shell commands, scripts, host profiles, environment variables, or command history. - Review existing shell histories and logs if real passwords may already have been used this way, and rotate affected credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: protocols.md:27
• Finding: RDP Certificate Validation Can Be Disabled<![CDATA[ ## Vulnerability Details **File Location**: `protocols.md:27` and `troubleshooting.md:72` **Vulnerability Type**: TLS server-certificate validation bypass **Risk Level**: High ### Vulnerable Code `protocols.md:27`: ```bash /cert:ignore # Skip cert validation (use carefully) ``` `troubleshooting.md:72`: ```bash xfreerdp /v:HOST /u:USER /sec:nla /cert:ignore ``` ### Technical Analysis The `/cert:ignore` option tells the RDP client to accept the server certificate without validating its identity. Encryption without server authentication does not prevent an active network attacker from impersonating the intended RDP server. The documentation presents this option as a general troubleshooting measure but does not require independent certificate fingerprint validation, certificate pinning, or use only inside an isolated test environment. ### Attack Path 1. A user encounters an RDP certificate error and applies the documented `/cert:ignore` option. 2. An attacker positioned on the local network, gateway, VPN path, or another relevant network segment intercepts or redirects the connection. 3. The attacker presents an arbitrary certificate. 4. The RDP client accepts that certificate without validating the server identity. 5. Depending on the negotiated authentication flow and attacker capabilities, the attacker may capture authentication material, relay authentication, or intercept session traffic. ### Impact Assessment The primary impact is loss of RDP server authenticity and exposure to machine-in-the-middle attacks. Potential consequences include credential compromise, authentication relay, session interception, and connection to an attacker-controlled desktop. The actual scope depends on the authentication mechanism and the attacker's network position. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `/cert:ignore` from ordinary connection and troubleshooting examples. - Install a certificate issued by a trusted internal or public certification authority on the RDP server. - Connect using the hostname represented in the server certificate instead of an unverified address. - If a private or self-signed certificate is unavoidable, verify its fingerprint over an independent trusted channel and import or pin it explicitly. - Document certificate errors as an identity-verification problem rather than recommending a validation bypass. - Limit any temporary bypass to an isolated test environment with no sensitive credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: troubleshooting.md:68
• Finding: Legacy RDP Security Downgrade Recommended as a Troubleshooting Step<![CDATA[ ## Vulnerability Details **File Location**: `troubleshooting.md:68-72` **Vulnerability Type**: Insecure protocol downgrade **Risk Level**: Medium ### Vulnerable Code ```bash # Try different security modes xfreerdp /v:HOST /u:USER /sec:tls xfreerdp /v:HOST /u:USER /sec:rdp xfreerdp /v:HOST /u:USER /sec:nla /cert:ignore ``` ### Technical Analysis The `/sec:rdp` option forces legacy RDP security instead of modern TLS or Network Level Authentication. Recommending it as a routine fallback encourages users to resolve compatibility failures by weakening transport and authentication protections. The adjacent alternative also disables certificate validation. Together, these troubleshooting instructions normalize security downgrades rather than addressing certificate, NLA, account-policy, or server-configuration failures. ### Attack Path 1. A connection fails under NLA or TLS. 2. The user follows the troubleshooting instructions and retries with `/sec:rdp`. 3. The session is established using weaker legacy RDP security. 4. An attacker with an appropriate network position targets the downgraded connection using interception, downgrade, or legacy-protocol attacks. 5. Session confidentiality or authentication material may be compromised, depending on the environment and negotiated protocol details. ### Impact Assessment This issue reduces the confidentiality and integrity assurances of the RDP connection. A successful network attack may expose session information or credentials and could lead to unauthorized access under the affected account. Exploitation generally requires network proximity or control over part of the communication path. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `/sec:rdp` from general troubleshooting guidance. - Require NLA with validated TLS certificates for normal RDP use. - Diagnose the underlying failure by checking certificates, supported cipher suites, clock synchronization, account policy, NLA configuration, and client/server compatibility. - If legacy RDP must be tested for a documented compatibility reason, restrict the test to an isolated trusted network and temporary nonprivileged account. - Clearly state that legacy security must not be used over untrusted networks. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: troubleshooting.md:175
• Finding: Unauthenticated PulseAudio TCP Service Exposed for Audio Forwarding<![CDATA[ ## Vulnerability Details **File Location**: `troubleshooting.md:175-181` **Vulnerability Type**: Unauthenticated network service exposure **Risk Level**: High ### Vulnerable Code ```bash **VNC:** VNC doesn't support audio natively. Use PulseAudio network streaming: ```bash # On server pactl load-module module-native-protocol-tcp auth-anonymous=1 # On client PULSE_SERVER=tcp:HOST:4713 firefox ``` ``` ### Technical Analysis Loading `module-native-protocol-tcp` with `auth-anonymous=1` permits clients to connect without authenticating. The command does not bind the service to loopback, constrain allowed source addresses, require a PulseAudio cookie, or place the connection inside the SSH tunnels recommended elsewhere in the skill. If TCP port 4713 is reachable, an untrusted network client may interact with the user's PulseAudio server. The precise capabilities depend on PulseAudio configuration, but access can affect audio streams and devices associated with the account running the server. ### Attack Path 1. The user runs the documented `pactl` command on a remote desktop host. 2. PulseAudio begins accepting TCP connections with anonymous authentication. 3. Port 4713 is reachable from another system because of the host's interface and firewall configuration. 4. An attacker connects to the PulseAudio native protocol without credentials. 5. The attacker abuses the exposed audio service to interact with available audio streams or devices within the PulseAudio user's session. ### Impact Assessment Potential impact includes audio privacy loss, unauthorized audio playback or capture, disruption of audio services, and access to PulseAudio resources belonging to the affected user. The service does not directly grant root privileges, but it may expose sensitive microphone or application audio available in that user's session. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not enable anonymous PulseAudio authentication. - Bind the PulseAudio TCP listener to loopback and forward it through an authenticated SSH tunnel. - Alternatively, require PulseAudio cookie authentication and limit allowed source addresses to an explicitly trusted host or subnet. - Apply host-firewall rules that prevent port 4713 from being reached by untrusted networks. - Unload the module after the remote session ends. - Prefer a remote-desktop solution with authenticated, encrypted audio forwarding rather than exposing the PulseAudio native protocol. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: troubleshooting.md:31
• Finding: Unrestricted Firewall Rules Expose RDP and VNC Services<![CDATA[ ## Vulnerability Details **File Location**: `troubleshooting.md:31-34` **Vulnerability Type**: Overly permissive firewall configuration **Risk Level**: High ### Vulnerable Code ```bash # Open firewall sudo ufw allow 3389/tcp # RDP sudo ufw allow 5901/tcp # VNC :1 ``` ### Technical Analysis These UFW rules permit inbound RDP and VNC traffic without specifying a trusted source address, interface, or private subnet. On an internet-facing host, the services can consequently become publicly reachable. This directly conflicts with the core security guidance in `SKILL.md`, which says never to expose RDP or VNC directly to the internet and recommends SSH tunneling, VPN access, or restrictive firewall rules. VNC is particularly sensitive because its native security is weak, while public RDP endpoints are frequent brute-force and exploitation targets. ### Attack Path 1. A user troubleshooting connectivity runs one or both documented UFW commands. 2. UFW permits inbound traffic to ports 3389 or 5901 from any source covered by the default rule scope. 3. If the host has a public address, port forwarding, or exposure through a cloud security group, external scanners discover the service. 4. An attacker performs password guessing, credential stuffing, service fingerprinting, or exploits a vulnerable RDP/VNC implementation. 5. Successful authentication or exploitation provides a remote desktop session or service-level code execution, depending on the affected software and account. ### Impact Assessment The rules expand the attack surface to every network from which the host is reachable. A successful attack may provide interactive access with the privileges of the remote desktop account. Exploitation of a vulnerable service could potentially execute code under the service account and, in some deployments, a highly privileged system account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace unrestricted allow rules with source-restricted rules, for example permitting only a specific management address or trusted private subnet. - Prefer keeping RDP and VNC ports closed and reaching them through an authenticated SSH tunnel or VPN. - Bind VNC servers to loopback when they are intended exclusively for SSH tunneling. - Restrict rules to the required network interface where appropriate. - Verify cloud security groups, router port-forwarding rules, and upstream firewalls in addition to UFW. - Add explicit warnings that these ports must never be opened broadly on an internet-facing host. - Audit existing firewall rules and remove any unrestricted RDP or VNC exposure. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Hidden Instructions

High

• Category: Prompt Injection

Content

integration: pending

## Context
<!-- What you know about their setup -->
<!-- Client OS, common targets, network situation -->

## Preferences

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- Client OS, common targets, network situation -->

## Preferences
<!-- How they like to connect -->
<!-- Default protocol, resolution, tunnel preference -->

## Saved Hosts

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

**Ask before saving configs.** When a connection works, offer to save it: "Want me to save this config for next time?" Never save passwords.

**Be practical.** If they just want to connect fast, give the command. Don't lecture about security unless they're doing something dangerous.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The guide recommends using xfreerdp with /cert:ignore, which disables certificate validation and makes man-in-the-middle or host impersonation attacks much easier. Because this skill is specifically about remote desktop access over potentially untrusted networks, normalizing insecure fallback settings is especially dangerous.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The PulseAudio example enables `module-native-protocol-tcp` with `auth-anonymous=1`, which allows unauthenticated network audio access. That can expose microphone/speaker streams, permit unauthorized eavesdropping or audio injection, and expand the attack surface on the host.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

| Headless Linux | SSH + X11 forwarding | No desktop needed |

### 2. Security First
- Always prefer SSH tunneling over direct exposure
- Never expose RDP (3389) or VNC (5900) to internet directly
- Use SSH keys, not passwords
- If direct needed, use VPN or firewall rules

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**This skill does NOT:**
- Store passwords in plain text — use SSH keys or system keyring
- Auto-save configs without asking first
- Connect to hosts without explicit user command
- Make any network requests itself (you run the commands)
- Access any memory outside `~/remote-desktop/`

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template directs creation of local memory files that store sensitive infrastructure details such as hostnames, internal IPs, usernames, protocols, ports, and SSH tunnel commands. Even if intended for convenience, this creates a persistent inventory of remote-access information without any warning, minimization guidance, access controls, or consent language, increasing the risk of credential-adjacent leakage and lateral movement if the workstation or home directory is exposed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `xfreerdp` example includes `/p:PASS` directly on the command line, which can expose credentials through shell history, process listings, terminal logging, or monitoring tools. In a remote desktop administration guide, this is especially risky because it trains users to handle privileged access credentials insecurely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Recommending `/cert:ignore` with only a mild 'use carefully' note normalizes disabling certificate validation, which defeats server identity verification and enables man-in-the-middle interception. In the context of remote desktop connections, this could expose credentials, session contents, and shared clipboard or drive data to an attacker.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The Docker example pulls and runs `rustdesk/rustdesk-server` without a version tag or digest, so users may execute whatever image the registry serves at that moment. This creates supply-chain and reproducibility risk, especially for remote access infrastructure where a compromised or changed image could expose sensitive systems.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ss -tlnp | grep 22     # SSH

# Check firewall (on target)
sudo ufw status
sudo iptables -L -n | grep 3389
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The troubleshooting guide instructs users to open RDP and VNC firewall ports directly but does not warn that this exposes remote access services to the network and potentially the internet. In the context of a remote desktop skill, that omission is meaningful because these services are high-value attack targets and should not be exposed broadly without access restrictions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Restarting sshd after configuration changes can terminate or disrupt active remote sessions, potentially locking out administrators if the new configuration is invalid or if they are connected only through SSH. While not an exploit primitive by itself, omitting that operational risk in remote administration guidance can cause availability and access loss.

Static analysis

No suspicious patterns detected.