ClawHub
Back to skill

Security audit

Ssh Remote Control

Security checks across malware telemetry and agentic risk

Overview

This skill clearly teaches an agent how to control authorized remote computers over SSH, which is powerful but disclosed and aligned with its stated purpose.

Install this only for computers you own or are authorized to administer. Use a dedicated SSH key and restricted non-admin account, limit the key with authorized_keys options where possible, avoid exposing SSH broadly, and remember that screenshots, file reads, and remote commands can reveal or change sensitive data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown documents that the skill can create files, upload/download files, open/close applications, and run CLI commands on remote machines. Although there is a security section about SSH exposure, it does not explicitly warn users that the skill may alter files, affect running applications, or change the remote system when invoked.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The feature examples show remote screenshot capture, which can collect potentially sensitive on-screen information from the controlled device. The existing security notes focus on tunnel and SSH access controls, but do not disclose the privacy implications of capturing screen contents.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The manifest description and nearly all instructional content are written in Chinese, with no indication that users can choose another language or locale. Under the policy for natural-language violations, forcing a specific language without opt-in is in scope unless the locale constraint is clearly documented and justified, which it is not here.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
**软件控制 (macOS)**：
```bash
# 打开应用
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'open -a Safari'

# 截屏
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'screencapture ~/Desktop/screenshot.png'
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
3. **重启SSH服务**
   ```bash
   sudo systemctl restart sshd
   ```

4. **配置内网穿透**（同上）
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.