智能体云沙箱 / 远程桌面

• Outcome: Review
• Latest audit: Oct 1, 2026 · 4:25 PM UTC
• Version: 1.0.4

Overview

This skill is purpose-aligned for remote desktops, but it handles cloud and Windows credentials in ways that users should review carefully before installing.

Install only if you are comfortable giving the skill access to create and destroy AstraFlow sandboxes and handle RDP credentials. Avoid reusing high-value Windows passwords, verify the RDP host independently, treat clipboard sync as sensitive, and clean up running sandboxes after use to avoid exposure or cost.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge_windows_uhost.py:81

Finding

RDP Server Certificate Validation Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/bridge_windows_uhost.py, lines 81–82
Vulnerability Type: Improper certificate validation during RDP authentication
Risk Level: High

Code Snippet:

python

# Use /from-stdin:force to start xfreerdp without exposing the plaintext password in the process arguments
cat /tmp/.rdp_pass | nohup xfreerdp /v:{args.host_ip} /u:{args.user} /from-stdin:force /cert:ignore /size:1920x1020 /bpp:24 +clipboard /dynamic-resolution >/tmp/rdp.log 2>&1 &

Technical Analysis

The command invokes xfreerdp with /cert:ignore, which disables validation of the RDP server's certificate. The script then supplies the user-provided Windows password to that unauthenticated endpoint through standard input.

Although using /from-stdin:force prevents the password from appearing directly in process arguments, it does not establish the identity of the remote server. An attacker capable of intercepting, redirecting, or spoofing the network connection can present an arbitrary RDP certificate without causing the client to abort.

The destination is selected through --host-ip, and the password is obtained through protected interactive input or --password-stdin. These are expected inputs, but the connection crosses from the trusted AstraFlow sandbox to a network endpoint whose identity is not verified.

Attack Path

1. The user invokes the bridge script for a Windows host and supplies valid RDP credentials.
2. The script writes the password to a mode-restricted temporary file in the remote sandbox.
3. An attacker with a suitable network position redirects or intercepts traffic intended for the configured RDP host.
4. The attacker presents a spoofed RDP server certificate.
5. Because xfreerdp is invoked with /cert:ignore, certificate mismatch or lack of trust does not stop the connection.
6. The script sends the Windows authentication credentials to the spoofed endpoint, pot ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

• Remove /cert:ignore and make certificate validation failures fatal.
• Validate the RDP server certificate against a trusted certificate authority where supported.
• For private or self-signed deployments, require the user to provide an expected certificate fingerprint and verify an exact match before transmitting credentials.
• Use a trust-on-first-use mechanism only if the initial fingerprint is confirmed through an independent trusted channel; store pinned fingerprints with restrictive permissions.
• Do not silently fall back to disabled validation. If certificate verification cannot be completed, abort before reading or transmitting the RDP password.
• Document certificate enrollment and rotation procedures so operators can securely maintain certificate pinning.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/bridge_windows_uhost.py (reported line 84)May include surrounding context.

python

sleep 2

# 立即彻底销毁密码临时文件
shred -u /tmp/.rdp_pass 2>/dev/null || rm -f /tmp/.rdp_pass
sleep 2

ps aux | grep [f]reerdp || true

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/example.py (reported line 41)May include surrounding context.

python

print(f"[OK] 已找到 'ucloud' CLI：{cli_path}")

    # 检查凭据
    cred_file = os.path.expanduser("~/.ucloud/credential.json")
    if os.path.isfile(cred_file):
        print(f"[OK] 已找到 UCloud CLI 凭据：{cred_file}")
    else:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 112)May include surrounding context.

python

if [ -n "$PROXY_VAL" ]; then
    PROXY_OPT="--proxy-server=${PROXY_VAL}"
  fi
  shred -u /tmp/.chrome_proxy_conf 2>/dev/null || rm -f /tmp/.chrome_proxy_conf
fi

if [ "${START_APPS:-0}" = "1" ]; then

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 147)May include surrounding context.

python

tz = "America/Los_Angeles"
    else:
        tz = "Asia/Shanghai"
    sb.commands.run(f"sudo ln -sf /usr/share/zoneinfo/{tz} /etc/localtime; echo '{tz}' | sudo tee /etc/timezone >/dev/null")

    if args.proxy:
        print("正在以安全方式为 Chrome 注入代理配置...")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to run shell commands, install packages, set environment variables containing API keys, and pass secrets to scripts, but it does not declare any tool scope or allowed-tools/permissions metadata. This creates an authorization gap: an agent platform may permit shell and environment access implicitly or inconsistently, increasing the chance of unintended command execution or secret exposure when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises real-time bidirectional clipboard sync between a browser-accessed remote desktop and client environment, but provides no warning about sensitive data leakage, accidental paste of secrets, or clipboard exfiltration across trust boundaries. In a remote sandbox/RDP/noVNC context, clipboard sharing materially increases the chance that credentials, tokens, or private local data are unintentionally transferred to the remote host or exposed back to the operator.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file includes its top-level description and subsequent user-facing CLI output in Chinese, which imposes a specific language on users. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bridge_windows_uhost.py (reported line 62)May include surrounding context.

python

print("正在沙箱内检查 / 安装 freerdp2-x11...")
    sb.commands.run(
        "which xfreerdp >/dev/null 2>&1 || (DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq && DEBIAN_FRONTEND=noninteractive sudo apt-get install -y -qq freerdp2-x11)",
        timeout=180,
    )

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 71)May include surrounding context.

python

print("正在沙箱内检查 / 安装 freerdp2-x11...")
    sb.commands.run(
        "which xfreerdp >/dev/null 2>&1 || (DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq && DEBIAN_FRONTEND=noninteractive sudo apt-get install -y -qq freerdp2-x11)",
        timeout=180,
    )

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 72)May include surrounding context.

python

print("正在沙箱内检查 / 安装 freerdp2-x11...")
    sb.commands.run(
        "which xfreerdp >/dev/null 2>&1 || (DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq && DEBIAN_FRONTEND=noninteractive sudo apt-get install -y -qq freerdp2-x11)",
        timeout=180,
    )

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 147)May include surrounding context.

python

print("正在沙箱内检查 / 安装 freerdp2-x11...")
    sb.commands.run(
        "which xfreerdp >/dev/null 2>&1 || (DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq && DEBIAN_FRONTEND=noninteractive sudo apt-get install -y -qq freerdp2-x11)",
        timeout=180,
    )

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code base64-encodes the RDP password locally and interpolates it directly into the string passed to sb.commands.run, so the secret still traverses the sandbox command channel and may be exposed in client-side logs, server-side command logging, job telemetry, or debugging traces. The comment claims protection against ps//proc leakage inside the sandbox, but overstates end-to-end secrecy because the password is already embedded in a remotely executed command before the temp file is even created.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Although xfreerdp itself receives the password via stdin, the generated shell script and command-launch path still contain the workflow that depends on a plaintext-derived secret already written through sb.commands.run. This creates a false sense of safety: process arguments may be clean, but the secret can still be exposed earlier in the orchestration layer, command history, logging, or sandbox-control-plane inspection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing docstrings and console output entirely in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and subsequent CLI output are written in Chinese, which imposes a specific language on users. The file does not offer any user opt-in, alternate locale, or justification that this tool is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/bridge_windows_uhost.py (reported line 80)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 68)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 76)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 81)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 86)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 91)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 118)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 68)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 76)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage_sandbox.py (reported line 81)May include surrounding context.

python

done
WATCHER
chmod +x "$WATCH"
setsid nohup "$WATCH" >/dev/null 2>&1 </dev/null &

if ! command -v websockify >/dev/null 2>&1 || [ ! -f /usr/share/novnc/vnc.html ]; then
  DEBIAN_FRONTEND=noninteractive sudo apt-get update -qq >/dev/null 2>&1