ClawHub
Back to skill

Security audit

Mac Node Bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear SSH-bridge purpose, but its installer can create persistent wrappers from insufficiently validated host/path data, which could allow command execution if those inputs are malicious.

Install only after the wrapper-generation scripts are hardened or you fully trust every installer input and every target Mac. Use dedicated non-root SSH accounts, pin host identities, avoid broad tools like brew or gh unless needed, inspect generated wrappers before use, and remove wrappers you no longer need.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install-wrapper.sh:53
Finding

Generated SSH Wrapper Allows Local Shell Command Injection

Content
View full analysis
&2; exit 1; } [[ "$REMOTE_BIN" = /* ]] || { echo "remote-bin must be an absolute path" >&2; exit 1; } mkdir -p "$TARGET_DIR" wrapper="$TARGET_DIR/$safe_name" ssh_opts=() if [[ -n "$SSH_KEY" ]]; then ssh_opts+=("-i" "$SSH_KEY" "-o" "IdentitiesOnly=yes") fi if [[ -n "$KNOWN_HOSTS" ]]; then ssh_opts+=("-o" "UserKnownHostsFile=$KNOWN_HOSTS") fi cat > "$wrapper" <
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/verify-node-tool.sh:91
Finding

Explicit Remote Binary Verification Allows Remote Shell Injection

Content
View full analysis
&2; exit 1; } ssh -T "$HOST" "test -x '$REMOTE_BIN' && printf 'OK %s\n' '$REMOTE_BIN' || { printf 'MISSING %s\n' '$REMOTE_BIN' >&2; exit 1; }" ``` ### Technical Analysis `REMOTE_BIN` is embedded directly into a remote shell command between single quotes. The script only verifies that the value starts with `/`; it does not escape embedded single quotes or reject shell control characters. A value such as the following passes the absolute-path check: ```text /tmp/tool'; id > /tmp/verification-injected; # ``` The resulting remote command is structurally equivalent to: ```bash test -x '/tmp/tool'; id > /tmp/verification-injected; #' && printf ... ``` The embedded single quote closes the intended path literal, and the semicolon begins a new command. Because the assembled string is passed to SSH as a remote command, the injected command runs on the target Mac under the authenticated SSH account. ### Attack Path 1. An attacker controls or influences the `--bin` argument used by a verification workflow. 2. The attacker supplies a value beginning with `/` but containing a single quote followed by shell commands. 3. The value passes the absolute-path validation. 4. The script embeds it into the SSH remote-command string without escaping. 5. The remote login shell parses the injected command. 6. The command executes on the Mac node with the privileges of the configured SSH user. ### Impact Assessment Exploitation allows arbitrary command execution on the selected Mac node as the SSH account used by the gateway. Depending on that account's permissions and macOS privacy grants, an attacker may be able to: - Read or modify files owned by the SSH user. - Access d ...[truncated 404 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install-preset.sh:111
Finding

Untrusted Remote Discovery Output Is Converted into Persistent Executable Source

Content
View full analysis
&2 echo "Pass --remote-bin explicitly if the tool is installed in a custom location." >&2 exit 1 fi } ``` ```bash TARGET_DIR="${TARGET_DIR:-$(resolve_target_dir)}" REMOTE_BIN="${REMOTE_BIN:-$(resolve_remote_bin "$HOST" "$TOOL" "$BREW_PREFIX")}" wrapper_name="${NAME:-$TOOL}" cmd=( "$INSTALL_WRAPPER" --name "$wrapper_name" --host "$HOST" --remote-bin "$REMOTE_BIN" --target-dir "$TARGET_DIR" ) [[ -n "$SSH_KEY" ]] && cmd+=(--ssh-key "$SSH_KEY") [[ -n "$KNOWN_HOSTS" ]] && cmd+=(--known-hosts "$KNOWN_HOSTS") "${cmd[@]}" ``` The discovery script returns paths using operations such as: ```bash if command -v "$TOOL" >/dev/null 2>&1; then command -v "$TOOL" exit 0 fi ``` ### Technical Analysis When `--remote-bin` is omitted, all standard output from the remote SSH discovery command is captured into `REMOTE_BIN`. The installer does not require exactly one output line, reject control characters, canonicalize the result, or verify that the response conforms to a safe path grammar before forwarding it to `install-wrapper.sh`. This crosses a critical trust boundary: data produced by the remote Mac is transformed into executable shell source on the Linux gateway. The downstream wrapper generator embeds `REMOTE_BIN` directly into a Bash script and only checks that it begins with `/`. A compromised remote account, manipulated remote shell startup, altered `command -v` environment, or malicious SSH endpoint could return a crafted value beginning with `/` and containing shell syntax. That response would pass the downstream absolute-path check a ...[truncated 1722 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
scripts/verify-node-tool.sh --host agent1@mac-mini.local --tool imsg

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
scripts/install-preset.sh \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
scripts/install-preset.sh \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
scripts/install-preset.sh \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
scripts/install-preset.sh \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
scripts/install-preset.sh \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
scripts/install-preset.sh \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly instructs users to run shell scripts and create SSH-based wrappers that execute commands on remote Mac nodes, but it declares no tool scope such as permissions or allowed-tools. That means an agent or platform may not have an explicit policy boundary around shell use, remote execution, or file writes, increasing the chance of overbroad command execution and unsafe deployment in environments that rely on metadata for enforcement.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install-wrapper.sh (reported line 79)May include surrounding context.

sh
exec ssh ${ssh_opts[*]:-} -T "$HOST" "bash -lc \$remote_cmd"
EOF

chmod 755 "$wrapper"
echo "Installed wrapper: $wrapper"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script executes a remote shell via SSH to inspect the target system, which is a safety-relevant operation for a code file. Although the usage text describes the script's purpose, there is no explicit warning, confirmation, or comment at the execution point indicating that a remote command will be run against the specified host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This line runs a remote command over SSH to test executable presence on the target host. For code files, subprocess or shell execution should have some visible disclosure; here there is no confirmation prompt, explanatory comment, or explicit runtime notice immediately associated with the action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script initiates an SSH session and runs a remote shell command to probe the target host, which is a safety-relevant operation under the code-file warning criteria. While the script name and arguments imply installation on a remote host, there is no confirmation prompt, inline comment, or user-facing disclosure near the execution point explaining that a remote command will be executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The script invokes install-wrapper.sh with parameters including target directory, wrapper name, and remote binary, indicating an installation action that likely creates or overwrites wrapper files. This file's usage text explains arguments and defaults but does not explicitly warn the user that running it will install a wrapper into the target directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This shell script creates a directory, writes a new executable wrapper file, and changes its permissions, but it does not provide a user-facing warning or confirmation before making those filesystem changes. The final "Installed wrapper" message appears only after the write has already occurred, so users are not informed in advance about the modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.