ClawHub
Back to skill

Security audit

Ssh Remote Control

Security checks for vulnerabilities and agentic risk

Overview

This skill openly enables AI-driven SSH control of remote computers, but its default setup grants persistent unrestricted access and understates the remaining risk.

Install only if you intend to let an AI agent operate a remote Mac or Linux account over SSH. Use a dedicated non-admin account and a dedicated key, restrict authorized_keys where possible, quote and validate SSH variables, keep the tunnel private or source-limited, log sessions, and document how to remove the key when finished.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:59
Finding

Unquoted SSH Configuration Variables Permit Argument Injection and Invocation Manipulation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
README.md:223
Finding

Quick-Start Procedure Grants Persistent and Unrestricted SSH Access

Content
View full analysis
> ~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys ``` The same authorization pattern appears in `SKILL.md`, lines 152-157. ### Technical Analysis Installing a public key is directly related to the declared SSH remote-control functionality and is not concealed behavior. However, the primary setup procedure appends an unrestricted key to the current user's `authorized_keys` file. The resulting authorization is persistent and normally permits every command, file operation, application action, and system capability available to that account. The Skill later recommends dedicated accounts and optional `authorized_keys` restrictions, but these controls are not incorporated into the quick-start configuration. The unrestricted default therefore exceeds the minimum privileges needed for bounded monitoring, file management, or application-control tasks. The documented command also provides no duplicate-key detection, key fingerprint verification, source restriction, forced command, forwarding restrictions, expiry mechanism, or automatic revocation procedure. Compromise of the Agent host or its private key consequently becomes compromise of the remote account. ### Attack Path 1. The user follows the quick-start instructions and appends the Agent's public key to the remote account's `authorized_keys`. 2. The key remains authorized across Skill runs and system restarts. 3. An attacker compromises the Agent server, reads the configured private key, gains access to an unlocked SSH agent, or otherwise obtains the dedicated credential. 4. The attacker connects through the exposed SSH or tunnel endpoint. 5. Because the key entry has no source, command, PTY, or forwarding restrictions, the attacker obtains the full SSH cap ...[truncated 917 chars]
Remediation
View remediation

other

Note
Location
README.md:282
Finding

Security Documentation Overstates the Protection Provided by Tunnel Shutdown

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (29)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Appending a key to ~/.ssh/authorized_keys establishes persistent remote access to the target account. In this skill's context that is intentional, but it is still a high-risk capability because misuse, mistaken key placement, or deployment on a sensitive account can create durable unauthorized access paths.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
88% confidence
Finding

The YARA hit is understandable because adding keys to authorized_keys is a common persistence technique used by attackers. Here it appears to be documented setup for legitimate SSH access, but in substance it still enables persistent remote entry, which is high impact if deployed carelessly or if the controlling private key is stolen.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

��────────┘

text

### 环境要求

- 远程设备开启 SSH 服务
- 内网穿透工具（如果设备在内网）
- SSH 密钥认证

### 快速开始

1. **被控电脑开启 SSH (macOS)**：
   - 系统偏好设置 → 共享 → 勾选"远程登录"

2. **生成 SSH 密钥对**：
```bash
ssh-keygen -t ed25519 -C "ai@server"
  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：
工具特点官网
花生壳国内老牌，稳定oray.com
ngrok国际流行，配置简单ngrok.com
frp开源免费，可自建服务器github.com/fatedier/frp
  1. 配置环境变量：
bash
export SSH_TARGET_HOST="你的穿透地址"
export SSH_TARGET_PORT="穿透端口"
export SSH_TARGET_USER="用户名"
export SSH_KEY_PATH="/path/to/private/key"
  1. **测�

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The finding is tied to the same authorized_keys setup sequence and therefore inherits the risk of persistent access creation. Although chmod itself is not credential access, in context this line participates in enabling key-based login that, if mismanaged, can expose the remote system to ongoing access.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This English duplicate also instructs adding an SSH public key to authorized_keys, which creates lasting remote login capability. For a remote-control skill this is expected, but it remains security-sensitive because compromise of the paired private key or overly broad account privileges can result in full remote account access.

Content

Scanner excerpt · README.md (reported line 224)May include surrounding context.

  1. Add public key to remote device:
bash
echo "your-public-key" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This line is part of the same SSH key authorization workflow and thus contributes to establishing persistent remote access. The risk is contextual rather than inherently malicious: the skill is built for remote control, so mistakes in account choice or key handling materially increase exposure.

Content

Scanner excerpt · README.md (reported line 226)May include surrounding context.

bash
echo "your-public-key" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. Configure tunnel (if behind NAT):

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

Appending a key to ~/.ssh/authorized_keys establishes persistent remote access to the target host. Even though the stated purpose is legitimate setup, this mechanism is identical to a common persistence/backdoor technique, and in an agent skill that enables remote control it materially expands access if misused or applied to the wrong account.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

  1. 添加公钥到远程电脑
    bash
    echo "公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
95% confidence
Finding

The YARA match is substantively valid because echo ... >> ~/.ssh/authorized_keys is the same primitive used to create persistent SSH access. In this skill's context, the action is framed as onboarding for legitimate remote management, but it still enables durable access to a user device and becomes dangerous if the agent, server, or key is compromised.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'docker ps'

text

## 远程电脑配置要求

### macOS 配置步骤

1. **开启远程登录**
   - 系统偏好设置 → 共享 → 勾选"远程登录"
   - 设置允许访问的用户

2. **生成SSH密钥对**
   ```bash
   ssh-keygen -t ed25519 -C "ai@server"

  1. 添加公钥到远程电脑

    bash
    echo "公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

  2. 配置内网穿透（如果电脑在内网）

    为什么需要内网穿透？ 大多数家庭/办公网络的电脑没有公网IP，无法直接从外网访问。内网穿透工具可以将内网端口映射到公网，让外部设备能够连接进来。

    常用内网穿透工具：

    工具特点官网
    花生壳国内老牌，稳定，支持SSHoray.com
    ngrok国际流行，配置简单ngrok.com

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

bash
   echo "公钥内容" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果电脑在内网）

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

bash
   echo "公钥内容" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果电脑在内网）

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

bash
   echo "公钥内容" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果电脑在内网）

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

bash
   echo "公钥内容" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果电脑在内网）

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

bash
   echo "公钥内容" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果电脑在内网）

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 225)May include surrounding context.

  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

  1. 添加公钥到被控电脑：
bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 226)May include surrounding context.

bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

bash
echo "你的公钥内容" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
  1. 配置内网穿透（如果设备在内网）：

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README promotes remote upload, app control, and screenshot capture but does not prominently warn that these capabilities can alter remote data and expose sensitive user information such as documents, browser contents, or on-screen secrets. In a skill specifically designed for AI-driven remote control, understated warnings increase the risk of unsafe deployment or overbroad use on personal devices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides concrete remote-control examples including file creation, upload/download, application control, process inspection, and screenshot capture before presenting a clear, prominent warning about privacy, data loss, and system-state changes. In an agent skill, these examples normalize high-impact actions and may cause an agent or operator to perform invasive operations without explicit consent gating.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

bash
# 查看目录
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'ls -la ~/Desktop/'

# 查看文件内容
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'cat ~/Desktop/test.txt'

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 255)May include surrounding context.

bash
# 查看目录
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'ls -la ~/Desktop/'

# 查看文件内容
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'cat ~/Desktop/test.txt'

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
# 查看目录
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'ls -la ~/Desktop/'

# 查看文件内容
ssh -i $SSH_KEY_PATH -p $SSH_TARGET_PORT $SSH_TARGET_USER@$SSH_TARGET_HOST 'cat ~/Desktop/test.txt'

Static analysis

No suspicious patterns detected.