Ssh Remote Sanitized

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This SSH administration skill is coherent, but it gives broad remote control while missing important safeguards around credentials, host identity, command construction, destructive actions, and target selection.

Review this skill carefully before installing, especially for production servers. Use only least-privilege SSH accounts and dedicated keys, avoid storing passwords or key passphrases in the JSON config, verify server host keys out of band, and do not run destructive or sudo-backed operations unless you have separately validated the inputs and target host.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (9)

T09 · Insecure Skill Coding Practices

Error

• Location: src/service.js:46

Finding

Privileged Remote Command Injection Through Service Names

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/log.js:19

Finding

Privileged Command Injection in Log Cleanup and Log Query Functions

Content

View full analysis

Remediation

View remediation

3650) { throw new Error('Invalid retention period'); } ``` - Apply similar limits to line counts. - Restrict container and systemd unit names to explicit safe character sets. - Canonicalize and allowlist log paths under approved directories such as `/var/log`. - Do not interpolate search expressions into shell commands. Transfer them through a safely quoted argument or perform filtering in JavaScript. - Separate privileged cleanup from general log-reading capabilities. - Require confirmation before deletion and support a dry-run mode that lists affected files. - Use a narrowly scoped privileged helper instead of granting broad sudo access to shell-composed commands. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/upload.js:51

Finding

Command Injection Through Upload Destinations and Preset Filenames

Content

View full analysis

{ ``` ```js conn.exec(`chmod ${settings.permissions} ${remotePath}`, (err) => { ``` ```js conn.exec(`sudo chown ${settings.owner} ${remotePath}`, (err) => { ``` ### Technical Analysis Remote directories and paths are inserted directly into shell commands without quoting or validation. In `uploadWithPreset`, `fileName` is used to construct `remotePath`, which is subsequently passed to both `chmod` and `sudo chown`. Although the permissions and owner fields come from fixed presets, the path remains attacker-controlled. Shell metacharacters in the path can terminate the intended command and introduce another command. The `chown` sink can expose the injected payload to a sudo-enabled execution context. SFTP operations do not require shell parsing and are safer, but the implementation switches back to shell commands for directory creation and metadata changes. ### Attack Path 1. A caller supplies a remote directory or preset filename containing shell separators. 2. The Skill uploads the file or attempts to create its directory. 3. It constructs a command such as: ```sh sudo chown www-data:www-data /var/www/html/name; attacker-command ``` 4. The remote shell executes the appended payload. 5. If sudo authorization permits the operation broadly, the payload may obtain privileged impact. ### Impact Assessment An attacker can execute commands under the remote SSH identity and may obtain root-level effects through the sudo operation. Consequences include: - Modification of privileged files. - Deployment of executable payloads. - Creation or replacement of service configuration. - Ownership changes affecting application integrity. - Persistent compromise of managed servers. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.js:47

Finding

SSH Connections Do Not Verify Remote Host Identity

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/exec.js:84

Finding

Unsafe Remote Script Staging Uses a Predictable Shared Temporary Path

Content

View full analysis

${tempFile} << 'EOF'\n${script}\nEOF`); await execSSH(serverName, `chmod +x ${tempFile}`); const result = await execSSH(serverName, `bash ${tempFile}`); await execSSH(serverName, `rm -f ${tempFile}`); ``` ### Technical Analysis The temporary filename is derived only from the current timestamp and is placed in the globally shared `/tmp` directory. Another user on the remote system may predict or race the path, including by creating a symbolic link before the file is written. The script is transferred through a shell heredoc with a fixed `EOF` delimiter. Script text containing a matching delimiter line can terminate the heredoc early and alter the surrounding shell command. Arbitrary script execution is a declared feature, but this construction still undermines reliable command boundaries and safe temporary-file handling. Cleanup is not protected by `finally`, so a failure during permission changes or execution can leave the script behind. ### Attack Path 1. A local attacker on the remote server predicts the timestamp-based path. 2. The attacker creates a symlink or conflicting file at that location. 3. The Skill redirects heredoc output to the attacker-selected path. 4. The Skill applies executable permissions and runs the resulting path. 5. Alternatively, crafted script text can terminate the fixed heredoc and change how the staging command is parsed. ### Impact Assessment The impact is limited to the privileges of the configured SSH account unless that account is privileged. Possible outcomes include: - Overwriting a file selected through a symlink race. - Executing attacker-controlled content. - Leaving sen ...[truncated 169 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/connect.js:82

Finding

SSH Passwords and Key Passphrases Are Stored in Plaintext Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/download.js:281

Finding

Preset Downloads Permit Local Path Traversal and Arbitrary File Replacement

Content

View full analysis

{ ``` ### Technical Analysis `fileName` is joined to a preset local base without rejecting traversal components such as `..`. A sufficiently crafted relative path can escape the intended download directory. The generic download operation also accepts unrestricted local destinations and overwrites existing files according to the underlying file-opening behavior. No dedicated storage root, overwrite confirmation, symbolic-link defense, or canonical containment check is present. ### Attack Path 1. An attacker supplies a preset filename containing repeated `../` components. 2. `path.join` normalizes the resulting path outside the preset directory. 3. The Skill downloads attacker-selected remote content to that local path. 4. If the Agent process can write the target, the existing file is replaced. 5. A strategically selected configuration or executable file can affect later Agent or system behavior. ### Impact Assessment The attacker can overwrite files writable by the local Agent process. Potential impact includes: - Corruption of Agent configuration or state. - Replacement of scripts or application assets. - Creation of persistent behavior if a startup-loaded file is writable. - Denial of service. - Local code execution when overwritten content is later executed or loaded. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.js:107

Finding

Unknown Server Names Silently Fall Back to the First Configured Host

Content

View full analysis

s.name === serverName) || servers[0]; if (!server) { throw new Error(`Server configuration not found: ${serverName}`); } ``` ### Technical Analysis When `serverName` does not match a configured alias, the implementation selects `servers[0]` instead of failing. The error condition only applies when no servers exist at all. This behavior can redirect a command, upload, service restart, security hardening action, or destructive log operation to an unintended system. The problem is particularly serious when the first entry is a production or privileged host. ### Attack Path 1. A user or attacker supplies a misspelled or nonexistent server alias. 2. Exact lookup fails. 3. The expression falls back to the first configured server. 4. The requested operation executes against that server without an explicit target-selection warning. ### Impact Assessment The vulnerability does not independently increase OS privileges, but it can apply existing SSH privileges to the wrong host. Consequences include: - Restarting or disabling services on production systems. - Uploading files to an unintended server. - Applying firewall or SSH configuration changes to the wrong host. - Deleting logs or executing arbitrary commands against an unintended target. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.json:15

Finding

Dependency Installation Is Not Reproducible or Integrity-Locked

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (101)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/快速配置指南.md (reported line 78)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/快速配置指南.md (reported line 81)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/快速配置指南.md (reported line 88)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The configuration example explicitly includes plaintext fields for 'password' and 'passphrase' alongside a private key path, normalizing storage of sensitive secrets in a local JSON config. If users follow this pattern, credentials may be left unencrypted on disk, committed to repositories, or exposed to other local processes and backups.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

"port": 22,
      "username": "SSH 用户名",
      "password": "SSH 密码（或使用私钥）",
      "privateKeyPath": "~/.ssh/id_rsa",
      "passphrase": "私钥密码（如有）"
    }
  ]

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 220)May include surrounding context.

md

1. **凭证安全**：妥善保管 SSH 密码和私钥，不要提交到代码仓库
2. **权限控制**：确保 SSH 用户有足够权限
3. **连接池**：避免创建过多并发连接
4. **命令安全**：避免执行危险命令（如 `rm -rf /`）
5. **生产环境**：生产环境操作前请备份

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 220)May include surrounding context.

md

1. **凭证安全**：妥善保管 SSH 密码和私钥，不要提交到代码仓库
2. **权限控制**：确保 SSH 用户有足够权限
3. **连接池**：避免创建过多并发连接
4. **命令安全**：避免执行危险命令（如 `rm -rf /`）
5. **生产环境**：生产环境操作前请备份

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 220)May include surrounding context.

md

1. **凭证安全**:妥善保管 SSH 密码和私钥,不要提交到代码仓库
2. **权限控制**:确保 SSH 用户有足够权限
3. **连接池**:避免创建过多并发连接
4. **命令安全**:避免执行危险命令(如 `rm -rf /`)
5. **生产环境**:生产环境操作前请备份

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

代码与描述在核心方向上基本一致，确实是一个 SSH 远程管理工具，并支持多服务器配置、连接复用、命令执行和文件传输。但描述声称支持系统监控、服务管理、日志分析、安全检查等更高层运维能力，而给出的代码中并未实现这些具体功能；仅提供了通用远程命令执行能力，理论上可被上层调用来完成这些任务，但这些能力并不是当前代码块直接实现的。因此描述相对代码存在一定夸大，属于能力声明与实际实现不完全一致。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documentation instructs users to reference a default private SSH key path (~/.ssh/id_rsa), which normalizes direct use of sensitive credentials by the skill. In a remote-management tool, encouraging broad access to a default private key can increase the blast radius of compromise, accidental disclosure, or misuse of highly privileged credentials.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

"host": "YOUR_SERVER_IP",
      "port": 22,
      "username": "YOUR_USERNAME",
      "privateKeyPath": "~/.ssh/id_rsa"
    }
  ]
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/快速配置指南.md (reported line 54)May include surrounding context.

md

"host": "192.168.1.100",
      "port": 22,
      "username": "root",
      "privateKeyPath": "/root/.ssh/id_rsa"
    },
    {
      "name": "staging",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documentation explicitly includes a destructive remote command example, rm /path/file, through a generic SSH execution interface. In an agent skill that can forward natural-language requests into remote shell actions, showcasing deletion without safeguards materially increases the risk of accidental or unauthorized data loss.

Content

Scanner excerpt · docs/快速配置指南.md (reported line 241)May include surrounding context.

ssh 执行 production ls -la /path # 列出文件 ssh 执行 production cat /path/file # 查看文件 ssh 执行 production tail -f /path/log # 实时日志 ssh 执行 production rm /path/file # 删除文件

text

---

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

cleanupOldLogs performs remote deletion of files under /var/log using sudo, which exceeds the expected semantics of a log viewing/analysis helper. In an SSH administration skill, this is especially dangerous because an upstream agent may call it automatically, causing loss of forensic evidence, operational visibility, or compliance-relevant logs on production systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code issues a destructive sudo delete command over SSH without any confirmation, preview, or safety interlock. In a remote operations skill, lack of a confirmation step materially increases the risk of accidental or automated execution against the wrong host, deleting logs needed for debugging, auditing, or incident response.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/log.js (reported line 210)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 57)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 75)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 78)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 79)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 82)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 164)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 196)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 203)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/security.js (reported line 265)May include surrounding context.

js

echo "4. 检查允许的用户:" &&
    grep -i "AllowUsers" /etc/ssh/sshd_config || echo "未限制用户" &&
    echo "" &&
    echo "5. 检查失败的登录尝试:" &&
    sudo lastb | head -10
  `);