ClawHub
Back to skill

Security audit

Persistent Sshfs

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about managing SSHFS mounts, but its setup relies on installing a mutable remote script with sudo and then running it persistently.

Review the downloaded persistent-sshfs script before installing, prefer pinning it to a known commit or checksum, and only enable the cron or systemd timer for trusted SSH hosts and mount paths you are comfortable keeping active across sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
## When NOT To Use

- You need password-based SSH auth — this script refuses it outright (`check_ssh_key_auth` only accepts `BatchMode=yes` + `PasswordAuthentication=no`, i.e. key-based).
- A one-off, single mount you'll tear down yourself — plain `sshfs` is simpler if you don't need auto-remount.
- Non-SSHFS mounts (NFS, SMB, etc.) — this script is SSHFS-specific (`fuse.sshfs` is hardcoded into the aliveness check).

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
## When NOT To Use

- You need password-based SSH auth — this script refuses it outright (`check_ssh_key_auth` only accepts `BatchMode=yes` + `PasswordAuthentication=no`, i.e. key-based).
- A one-off, single mount you'll tear down yourself — plain `sshfs` is simpler if you don't need auto-remount.
- Non-SSHFS mounts (NFS, SMB, etc.) — this script is SSHFS-specific (`fuse.sshfs` is hardcoded into the aliveness check).

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/setup.md (reported line 58)May include surrounding context.

md
## When NOT To Use

- You need password-based SSH auth — this script refuses it outright (`check_ssh_key_auth` only accepts `BatchMode=yes` + `PasswordAuthentication=no`, i.e. key-based).
- A one-off, single mount you'll tear down yourself — plain `sshfs` is simpler if you don't need auto-remount.
- Non-SSHFS mounts (NFS, SMB, etc.) — this script is SSHFS-specific (`fuse.sshfs` is hardcoded into the aliveness check).

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 13)May include surrounding context.

sh
# Debian/Ubuntu
sudo apt install sshfs

# Fedora/RHEL
sudo dnf install fuse-sshfs

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 19)May include surrounding context.

sh
# Debian/Ubuntu
sudo apt install sshfs

# Fedora/RHEL
sudo dnf install fuse-sshfs

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 109)May include surrounding context.

sh
# Debian/Ubuntu
sudo apt install sshfs

# Fedora/RHEL
sudo dnf install fuse-sshfs

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 110)May include surrounding context.

sh
# Debian/Ubuntu
sudo apt install sshfs

# Fedora/RHEL
sudo dnf install fuse-sshfs

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 16)May include surrounding context.

md
sudo apt install sshfs

# Fedora/RHEL
sudo dnf install fuse-sshfs

# Arch
sudo pacman -S sshfs

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The instructions fetch an executable directly from a mutable GitHub raw URL tracking the master branch and then place it into /usr/local/bin with sudo. This creates a supply-chain risk: if the upstream repository is compromised or the branch changes maliciously, users may install attacker-controlled code with elevated trust.

Content

Scanner excerpt · references/setup.md (reported line 27)May include surrounding context.

sh
wget https://raw.githubusercontent.com/psyb0t/persistent-sshfs/master/persistent-sshfs
chmod +x persistent-sshfs
sudo mv persistent-sshfs /usr/local/bin/

Note: default branch is master (no release tags exist) — the raw URL above tracks master directly.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 110)May include surrounding context.

sh
sudo systemctl daemon-reload
sudo systemctl enable --now persistent-sshfs.timer
journalctl -u persistent-sshfs -f

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 119)May include surrounding context.

cron — boot + interval

sh
crontab -e
text