Security audit

Mac Node Bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill openly creates SSH wrappers for Mac tools, but its shell scripts have input-validation flaws that could let crafted host or path values run unintended commands.

Install only if you fully trust the host, path, key, and known-hosts values being supplied and are comfortable granting this gateway remote access to Mac-side tools. Before wider use, the scripts should validate SSH destinations, safely serialize generated wrapper configuration, avoid concatenating paths into remote shell strings, and warn before overwriting existing wrapper files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install-wrapper.sh:57
Finding: Shell Code Injection in Generated SSH Wrapper
Content: View full analysis
&2; exit 1; } [[ "$REMOTE_BIN" = /* ]] || { echo "remote-bin must be an absolute path" >&2; exit 1; } mkdir -p "$TARGET_DIR" wrapper="$TARGET_DIR/$safe_name" ssh_opts=() if [[ -n "$SSH_KEY" ]]; then ssh_opts+=("-i" "$SSH_KEY" "-o" "IdentitiesOnly=yes") fi if [[ -n "$KNOWN_HOSTS" ]]; then ssh_opts+=("-o" "UserKnownHostsFile=$KNOWN_HOSTS") fi cat > "$wrapper" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/verify-node-tool.sh:91
Finding: Remote Command Injection in Explicit Binary Verification
Content: View full analysis
&2; exit 1; } ssh -T "$HOST" "test -x '$REMOTE_BIN' && printf 'OK %s\n' '$REMOTE_BIN' || { printf 'MISSING %s\n' '$REMOTE_BIN' >&2; exit 1; }" ``` ### Technical Analysis `REMOTE_BIN` is concatenated into a command string that is interpreted by the remote login shell. Although the value is surrounded by single quotes, embedded single quotes are neither rejected nor escaped. The absolute-path check only verifies that the first character is `/`. A crafted value can begin with `/`, terminate the single-quoted string, add shell operators and commands, and then restore syntactic validity. Local quoting of `"$HOST"` and the overall command argument does not protect the value after SSH sends the constructed string for remote shell evaluation. This differs from passing user-controlled data as positional parameters to a fixed script. Here, data and remote shell syntax are combined in the same string. ### Attack Path 1. An attacker influences the value passed through `--bin`. 2. The supplied value starts with `/`, passing the absolute-path check. 3. The value contains a single quote followed by shell syntax. 4. The script concatenates that value into the SSH command string. 5. SSH sends the resulting command to the configured Mac node. 6. The remote login shell interprets the injected syntax. 7. The attacker's command executes as the configured remote SSH user. ### Impact Assessment Successful exploitation permits arbitrary command execution on the target Mac node under the configured SSH account. The attacker can read or modify files accessible to that account, invoke macOS tools for which the account has privacy permissions, alter user-level configuration, or compromise credentials available in that u ...[truncated 226 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install-preset.sh:71
Finding: Unvalidated SSH Destination Can Be Interpreted as SSH Options
Content: View full analysis
&2; exit 1; }" ``` The generated wrapper uses the same pattern: ```bash exec ssh ${ssh_opts[*]:-} -T "$HOST" "bash -lc \$remote_cmd" ``` ### Technical Analysis Shell quoting preserves each host value as one argument, but it does not prevent the SSH client from interpreting an argument beginning with `-` as an option. The scripts do not validate that the supplied host is a legitimate `USER@HOST` value or approved SSH alias, and they do not explicitly terminate SSH option parsing before the destination. A malicious destination may therefore inject SSH client options. Depending on the installed SSH client and supplied options, this can modify configuration loading, host-key handling, identity selection, or proxy behavior. Options such as a crafted proxy command can cause local command execution when SSH attempts to establish the connection. This issue is independently present during preset resolution and verification. It is also propagated into generated wrappers by the unsafe source generation identified separately. ### Attack Path 1. An attacker controls or influences a `--host` argument. 2. The attacker provides a value beginning with `-` that the SSH client recognizes as an option. 3. The shell passes the value as one argument, but SSH processes it as configuration rather than as ...[truncated 832 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
scripts/install-preset.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
scripts/install-preset.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
scripts/install-preset.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
scripts/install-preset.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
scripts/install-preset.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
scripts/install-preset.sh \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly instructs users to run shell scripts and install SSH-based wrappers, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: consumers and reviewers cannot tell from metadata that the skill is intended to invoke shell capabilities and remote execution over SSH, increasing the chance of overbroad or unintended execution.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install-wrapper.sh (reported line 79)May include surrounding context.
sh
exec ssh ${ssh_opts[*]:-} -T "$HOST" "bash -lc \$remote_cmd" EOF chmod 755 "$wrapper" echo "Installed wrapper: $wrapper"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script initiates an SSH session and executes a remote bash command on the target host, which is a safety-relevant operation under the code-file warning criteria. While the usage text describes the script's purpose, there is no explicit warning, confirmation, or user-facing disclosure at the execution point that a remote command will be run on the specified host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This code creates a target directory, writes a new executable file, and changes its permissions. Although the usage text says it 'creates a small wrapper script,' there is no explicit in-flow confirmation prompt or caution that an existing file at the target path may be overwritten.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This line performs a remote shell command over SSH to test executability of a path on another machine. Although the operation is limited, it is still subprocess-style remote execution and the script does not provide an explicit warning or confirmation at the point of action beyond generic usage text.
Content: No source excerpt is available for this finding.