ssh-executor

• Outcome: Review
• Latest audit: Jul 24, 2026 · 1:18 PM UTC
• Version: 2.4.2

Overview

This SSH skill is transparent about being powerful, but its sudo password handling can expose passwords and needs review before installation.

Install only if you need the Full edition's sudo/password features and can accept Review-level risk. Prefer the base/key-only edition or NOPASSWD for narrowly scoped commands. Do not use sudo password mode until the wrapper is fixed to pass secrets through protected stdin and to ensure error JSON and process arguments never contain passwords.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'vr' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

try:
        vr = _resolve_vault_bin()
        proc = subprocess.run(
            [vr, "resolve"],
            input=input_data.encode(),
            capture_output=True,

• Confidence: 83% confidence
• Finding: The executable path ultimately comes from the VAULT_RESOLVER_BIN environment variable, so a local attacker or untrusted execution environment could redirect the script to run an attacker-controlled binary. Although the code verifies that the target exists and is executable and does not invoke a shell, it still trusts environment-controlled code execution for a component that handles SSH private keys.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documentation claims the direct-SSH fallback should be used only for read-only commands, but the example permits an arbitrary remote command string. That mismatch weakens operator safeguards and can normalize using the unrestricted fallback for mutating or destructive actions outside the wrapper's safety checks.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The skill promises that stdout is always strict JSON, but later documents direct SSH fallback paths that do not satisfy that contract. This inconsistency can cause downstream tooling to misparse output, drop warnings, or make unsafe automation decisions based on malformed assumptions about result structure.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The module claims private keys are never logged or printed, but exception messages from key parsing or vault resolution are interpolated directly into JSON error output. If underlying libraries include PEM fragments or sensitive parsing context in exceptions, secret key material could be exposed to logs or calling systems, violating the stated security model.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The script explicitly warns that host validation should occur before invocation, but it does not enforce any allowlist, format restriction, or trust boundary on the supplied host. In a skill with broad remote-shell authority, accepting arbitrary user-provided hosts increases the risk of connecting to attacker-controlled systems, exfiltrating credentials, or executing commands in the wrong environment.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The usage text claims destructive commands and sudo require --confirm-dangerous, but the Python fallback only records the flag and forwards the remote command to ssh-client.py without any visible guard in this script. This creates a safety-control bypass where environments lacking the native SSH client may execute dangerous remote commands without the promised explicit approval.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script embeds the sudo password directly into the remote command string: `echo '${SUDO_PASS}' | sudo -S ...`. This exposes the secret to multiple disclosure paths, including local process arguments, remote shell history/logging, agent telemetry, and any JSON/error handling that captures the command string. In a credential-handling SSH executor, this context makes the issue more dangerous because the tool is explicitly designed to transport and run sensitive administrative actions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Security:**
- Password resolved in RAM, never on disk
- Sent via `echo '<pass>' | sudo -S -p ''` — password never appears on the command line (`ps`)
- `-p ''` suppresses sudo password prompt (avoids stderr pollution)
- Original command is base64-encoded to avoid quote escaping issues
- `--sudo` automatically enables `--confirm-dangerous` (no extra flag needed)

• Confidence: 78% confidence
• Finding: Using `sudo -S` with a piped password is a sensitive credential-handling pattern. In an LLM-driven environment, such patterns are especially risky because command generation, logs, or debugging output can accidentally expose secrets even if the password is not passed in argv.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Security:**
- Password resolved in RAM, never on disk
- Sent via `echo '<pass>' | sudo -S -p ''` — password never appears on the command line (`ps`)
- `-p ''` suppresses sudo password prompt (avoids stderr pollution)
- Original command is base64-encoded to avoid quote escaping issues
- `--sudo` automatically enables `--confirm-dangerous` (no extra flag needed)

• Confidence: 78% confidence
• Finding: Using `sudo -S` with a piped password is a sensitive credential-handling pattern. In an LLM-driven environment, such patterns are especially risky because command generation, logs, or debugging output can accidentally expose secrets even if the password is not passed in argv.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else

• Confidence: 98% confidence
• Finding: Using `sudo -S` with a password echoed from the command string is unsafe because it couples privileged execution with plaintext secret exposure. The issue is not sudo itself, but the insecure way the password is supplied.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi

• Confidence: 98% confidence
• Finding: This is the same unsafe `sudo -S` pattern in the executed command path. It creates a secret-handling vulnerability with potential compromise of sudo credentials and therefore privileged access.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else

• Confidence: 98% confidence
• Finding: Using `sudo -S` with a password echoed from the command string is unsafe because it couples privileged execution with plaintext secret exposure. The issue is not sudo itself, but the insecure way the password is supplied.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi

• Confidence: 98% confidence
• Finding: This is the same unsafe `sudo -S` pattern in the executed command path. It creates a secret-handling vulnerability with potential compromise of sudo credentials and therefore privileged access.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Security:**
- Password resolved in RAM, never on disk
- Sent via `echo '<pass>' | sudo -S -p ''` — password never appears on the command line (`ps`)
- `-p ''` suppresses sudo password prompt (avoids stderr pollution)
- Original command is base64-encoded to avoid quote escaping issues
- `--sudo` automatically enables `--confirm-dangerous` (no extra flag needed)

• Confidence: 72% confidence
• Finding: The documented use of a shell pipe to feed a sudo password combines secret handling with command chaining. In agentic environments, chaining patterns can be repurposed or malformed, increasing the chance of command injection, quoting errors, or accidental disclosure when the surrounding command is dynamically constructed.

Chaining Abuse

High

• Category: Tool Misuse

Content

size="$(stat -c '%s' "$pat" 2>/dev/null || echo '?')"

    if [[ "$force" == "--force" ]]; then
      shred -u "$pat" 2>/dev/null && rm -f "$pat"
      echo "  ✓ Removed: $pat ($pretty_age, ${size}B)" >&2
    else
      echo "  $pat  ($pretty_age, ${size}B)" >&2

• Confidence: 72% confidence
• Finding: The cleanup routine enumerates predictable temp-file patterns in world-writable directories and, when `--force` is used, shreds and removes matching files. If the script is run with elevated privileges, an attacker may be able to plant matching files or links and induce deletion of unintended targets, making this more dangerous because the skill explicitly handles sensitive files in shared temp locations.

Chaining Abuse

High

• Category: Tool Misuse

Content

ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else

• Confidence: 96% confidence
• Finding: The pipeline into `sudo` is a command-chaining construct that hides a sensitive credential flow and wraps arbitrary remote code execution. In this context the chaining is dangerous because it combines secret injection, privilege escalation, and shell decoding in a single opaque command string.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi

• Confidence: 96% confidence
• Finding: This occurrence is part of the same chained execution pattern that pipes a plaintext password into sudo and then executes a decoded shell payload. Such chaining impedes auditing and increases the blast radius if an attacker can observe or influence the command flow.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.