SSH Vault

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 PM UTC
• Version: 1.0.2

Overview

The skill is transparent about remote SSH execution, but it asks for overly broad vault access and stores reusable session state insecurely.

Install only if you are comfortable giving this agent remote command capability through your SSH vault. Before use, restrict registration to specific hosts, avoid the wildcard request, pin the Docker image by digest, bind the service to a private interface unless intentionally exposed, and store session data in a user-private file with restrictive permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Mutable Third-Party Container Image Used for Security-Sensitive Vault Service

Content

View full analysis

Remediation

View remediation

`. - Document the exact application version, source repository, build provenance, and digest verification procedure. - Use signed images and verify signatures or attestations before deployment. - Bind the published port to loopback by default, such as `127.0.0.1:3001:3001`, unless remote exposure is explicitly required. - Apply container hardening, including a non-root user, dropped Linux capabilities, a read-only root filesystem where practical, resource limits, and narrowly scoped volume permissions. - Establish a controlled upgrade process that reviews and pins every new image digest before deployment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/vault.mjs:124

Finding

Agent Registration Requests Access to Every Vault-Managed Host

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/vault.mjs:24

Finding

Vault Session Token Stored Unsafely in a Predictable Shared Temporary File

Content

View full analysis

Date.now()) return data; } } catch {} return null; } function saveSession(session) { writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2)); } ``` ### Technical Analysis The program stores the vault `sessionId` in the fixed, predictable path `/tmp/ssh-vault-session.json`. The shared temporary directory is normally accessible to multiple local users. The write operation does not specify restrictive file permissions, verify ownership, use exclusive creation, or prevent symbolic-link traversal. The resulting permissions depend on the process umask and may allow another local user to read the session data. In addition, `writeFileSync` follows an existing symbolic link. A local attacker may pre-create the expected path as a symbolic link to another file writable by the victim, causing the victim process to overwrite that target when an approved session is saved. The fixed path also causes session collisions among users or concurrent instances. Because the cached identifier is subsequently attached to privileged vault API requests, it must be treated as sensitive authentication material. ### Attack Path **Session disclosure path:** 1. A user completes the vault approval flow. 2. `saveSession` writes the returned `sessionId` and expiration time to `/tmp/ssh-vault-session.json`. 3. The file is created under an insufficiently restrictive umask or is otherwise accessible to another local user. 4. The local attacker reads the active session identifier. 5. The attacker attempts to reu ...[truncated 1285 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

node scripts/vault.mjs exec <host> <command> [timeout]

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes a registration path that asks the vault for broad agent access rather than limiting permissions to specific intended hosts or contexts. In a tool whose purpose is remote command execution, overbroad registration materially increases blast radius: if registration succeeds, the agent could be authorized far beyond what the manifest and user likely expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Using requestedHosts: ['*'] explicitly seeks unrestricted authorization to all hosts managed by the vault. That is dangerous because any compromise, misuse, or mistaken invocation of this agent could pivot into fleet-wide command execution instead of access to only the hosts needed for the current task.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill clearly requires access to environment variables and networked command execution against a vault service, but it declares no explicit tool scope or permission boundaries. That omission makes the skill harder to sandbox and review, increasing the chance that an agent can access secrets or perform network actions beyond what users expect.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The documentation instructs users to run a container from a mutable image reference using the latest tag. This creates a supply-chain risk because future pulls may fetch unexpected or compromised code, and users cannot reproduce or verify the exact image version they deployed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables arbitrary remote SSH command execution, explicitly allows shell metacharacters, and describes session reuse, yet it does not prominently warn that these actions can change or damage remote systems. In this context, missing warnings and guardrails are dangerous because the skill is intended for high-impact operations on real infrastructure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The documented behavior caches a session ID so subsequent commands can bypass the approval flow, enabling autonomous remote command execution after a single authorization. In a skill whose core function is arbitrary SSH access, this materially increases the risk of lateral movement, unintended repeated actions, and abuse if the agent or session store is compromised.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

data: {"status":"executing"} data: {"status":"completed","stdout":"...","stderr":"...","exitCode":0,"sessionId":"..."}

text

4. Save `sessionId` to `/tmp/ssh-vault-session.json` — subsequent commands skip approval

Shell metacharacters (`&&`, `;`, `|`, `$()`, backticks) are all allowed in commands.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as executing commands on existing vault-managed hosts, but the documentation also includes host-management functionality through the vault API. This expands the operational scope from execution to infrastructure enrollment, increasing the chance an agent can alter the trusted host set or stage access to additional systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Including host registration/onboarding in a skill whose stated purpose is command execution violates least privilege and introduces a stronger persistence and expansion vector. If abused, an agent could request or facilitate enrollment of new hosts and credentials, extending its reach beyond approved systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code stores session data in /tmp/ssh-vault-session.json without setting restrictive file permissions or using a more secure credential store. On multi-user systems or shared environments, this can expose active session identifiers to other local users or processes, enabling unauthorized use of the vault session until expiration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Hardcoding the registration name as 'openclaw' conflicts with the manifest statement that the skill is not for openclaw nodes. This mismatch can cause operators to misclassify the agent, accidentally grant inappropriate trust, or bind the skill to environments it was explicitly not meant to target.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range, which allows installation of newer matching versions over time instead of a single fixed artifact. In a security-sensitive skill that signs SSH vault API requests using cryptographic libraries, this increases supply-chain risk because a compromised or breaking upstream release could be pulled into future installs without explicit review.

Content

Scanner excerpt · scripts/package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "libsodium-wrappers": "^0.8.2"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The exec command sends a host and command to the vault API for remote execution, which is a safety-relevant subprocess-like operation on external systems. Although remote execution is part of the command's stated purpose, the implementation does not provide any runtime confirmation or warning that the command will be executed on the specified host.

Content

No source excerpt is available for this finding.