WORKSTATION.md - Your Agent's Own Linux Server

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:38 AM UTC
• Version: 1.0.3

Overview

This skill is coherent for provisioning temporary cloud workstations, but it gives an agent broad infrastructure, public deployment, global install, and SSH credential authority with too little user control.

Install only if you are comfortable letting an agent install a global npm CLI, create or reuse SSH keys, provision a public internet server, and run commands as root. Prefer a dedicated SSH key, explicit approval before creation or publication, pinned package versions, and cleanup with the destroy command when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Global Installation of an Executable npm Package

Content

View full analysis

Remediation

View remediation

``` 2. Verify the package archive against an expected integrity hash or signed release before execution. 3. Review whether the package requires lifecycle scripts. Disable them with `--ignore-scripts` when they are unnecessary. 4. Install the CLI in a temporary, project-scoped directory or isolated container instead of modifying the global host environment. 5. Use a lockfile where applicable and incorporate dependency scanning and release-review procedures. 6. Run the client as an unprivileged account with access limited to the files required for provisioning. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Creation and Reuse of an Unencrypted Default SSH Identity

Content

View full analysis

/dev/null || ls ~/.ssh/id_rsa.pub 2>/dev/null || ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519 ``` ```bash workstation create --pubkey "$(cat ~/.ssh/id_ed25519.pub)" --name ``` ### Technical Analysis SSH authentication is consistent with the Skill's declared remote-server provisioning function. However, the implementation exceeds minimum privilege by reusing or modifying the user's default SSH identity location rather than using a dedicated, service-scoped credential. If neither listed public key exists, `ssh-keygen` creates `~/.ssh/id_ed25519` with an empty passphrase because of `-N ""`. Anyone who later obtains read access to that private key can use it without an additional passphrase. If an existing Ed25519 key is present, its public component is submitted to an external provisioning service, causing a potentially general-purpose identity to be reused for the temporary workstation. The selection logic is also inconsistent. It accepts an existing RSA public key as satisfying the key check, but the provisioning command always reads `~/.ssh/id_ed25519.pub`. If only `id_rsa.pub` exists, the check succeeds while the subsequent command attempts to read a nonexistent Ed25519 public key. This can cause provisioning failure or encourage unsafe manual credential workarounds. The public key itself is not a secret, and the displayed commands do not read or transmit the private key. The primary concerns are the creation of an unencrypted private credential at a default path, reuse of a broadly scoped identity, and authorization of that identity for root access to an internet-connected server. ### Attack Path 1. The Agent follows the Skill and checks the user's ...[truncated 1551 chars]

Remediation

View remediation

``` 3. Protect the dedicated private key with a passphrase or use an SSH agent, short-lived certificate, or other ephemeral authentication mechanism. 4. Enforce restrictive directory and file permissions: ```bash chmod 700 "$HOME/.ssh" chmod 600 "$key_path" chmod 644 "${key_path}.pub" ``` 5. Keep track of the selected key path instead of checking one key type and unconditionally reading another. 6. Remove the public-key authorization when the workstation is destroyed. If the key is exclusively dedicated to an expired workstation and retention is unnecessary, securely delete the local key after obtaining user approval. 7. Document the external service receiving the public key, its retention policy, and the duration and scope of the resulting root authorization. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# Check for existing key, create one if needed
ls ~/.ssh/id_ed25519.pub 2>/dev/null || ls ~/.ssh/id_rsa.pub 2>/dev/null || ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519

Step 3: Create a WORKSTATION

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

bash

# Check for existing key, create one if needed
ls ~/.ssh/id_ed25519.pub 2>/dev/null || ls ~/.ssh/id_rsa.pub 2>/dev/null || ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519

Step 3: Create a WORKSTATION

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# Check for existing key, create one if needed
ls ~/.ssh/id_ed25519.pub 2>/dev/null || ls ~/.ssh/id_rsa.pub 2>/dev/null || ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519

Step 3: Create a WORKSTATION

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages an agent to self-provision an internet-facing Linux server with full root access and a public URL, but it does not require any explicit user consent, risk disclosure, or confirmation before creating exposed infrastructure. In an agent context, this is dangerous because it can cause unintended external exposure, operational cost, and deployment of unreviewed services under a user-associated name without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to inspect local SSH key material and transmit a public key to an external service without any privacy notice, credential-handling guidance, or user approval step. Although only public keys are transmitted, the workflow still accesses local authentication artifacts and normalizes credential-related operations without transparency, which is risky for an autonomous agent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.