ClawHub
Back to skill

Security audit

SSH OP

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks to manage SSH and 1Password access while the shipped package is incomplete and can persistently modify SSH configuration.

Install only after reviewing the package contents. The intended SSH/1Password behavior is sensitive and the main ssh-op executable is missing, so verify the publisher, add only host aliases you trust, and understand that config.env and ~/.ssh/config changes will persist across sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on using an ssh-op helper to retrieve a private key from 1Password, load it into ssh-agent, and run ssh. This code chunk only manages a marked section in ~/.ssh/config by inserting or updating host alias configuration from a snippet file. While editing ~/.ssh/config is mentioned as part of onboarding in the description, that is only a secondary/supporting task. The actual code lacks the primary declared behaviors and instead performs a narrower configuration-file management function, so the description does not accurately represent this code chunk on its own.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_ssh_config.py (reported line 49)May include surrounding context.

python
snippet = snippet_path.read_text(encoding="utf-8").rstrip() + "\n"

    ssh_dir = Path.home() / ".ssh"
    ssh_dir.mkdir(parents=True, exist_ok=True)
    config_path = ssh_dir / "config"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill instructs the agent to read and write local files such as config.env, hosts.conf, and ~/.ssh/config, but it declares no explicit tool scope or permission boundaries. In an agent setting, missing scope makes these filesystem capabilities implicit and easier to misuse, increasing the chance of unauthorized persistence or modification of sensitive SSH configuration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

The onboarding flow explicitly tells the agent to collect configuration details in chat and write them to a persistent config.env file, creating session persistence of sensitive operational data. In this context, those values may include 1Password vault names, item titles, host aliases, and potentially service-account related setup, which can outlive the session and expand the blast radius if the host or account is later compromised.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
Because the primary interface is chat (Telegram), the preferred onboarding flow is:

1. Ask Boss the required questions in chat.
2. Write the real config file: `config.env`.
3. Run a smoke test (e.g. `ssh-op --help` and a safe `ssh-op -T <alias>`).

### Optional (terminal)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The docstring states the managed block can be updated idempotently, implying the script will recognize and replace an existing managed section. However, the implementation later builds a regex with \Q...\E quoting syntax, which Python's re module does not support, so the managed-block matching logic does not behave as documented and likely fails at runtime before any idempotent update occurs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/onboard.sh (reported line 70)May include surrounding context.

sh
write_real_config "$vault" "$item" "$field" "$fp"

  echo "\nNext: ensure ssh-op is on PATH (optional):"
  echo "  mkdir -p ~/.local/bin && ln -sf ~/.openclaw/skills/ssh-op/scripts/ssh-op ~/.local/bin/ssh-op"

  echo "\nTest (will prompt for host alias):"
  echo "  ssh-op -T <host-alias>"

Static analysis

No suspicious patterns detected.