ClawHub
Back to skill

Security audit

ssh-full

Security checks across malware telemetry and agentic risk

Overview

This SSH skill is mostly coherent, but it handles privileged remote access and credentials in ways that need careful review before installation.

Install only if you genuinely need full remote SSH execution with sudo and password authentication. Prefer the base key-only edition when possible, use least-privilege SSH accounts, avoid password-based sudo, restrict approved vault backends explicitly, and require per-command user approval for any mutating or privileged operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The permission declaration states web access is limited to localhost, but the skill explicitly supports arbitrary external vault backends such as 1Password, Bitwarden, and custom wrappers that may perform remote network access. This creates a misleading trust boundary: deployers may grant narrower egress assumptions than the skill actually needs, increasing the risk of unintended credential transmission to external services.

Scope Creep

Medium
Confidence
96% confidence
Finding
The early documentation advertises pluggable credential backends including third-party vault CLIs, while the MCP permissions section later declares web access as 'localhost only'. That mismatch can cause operators to under-scope review and monitoring, and a custom backend could exfiltrate secrets over the network while appearing compliant with the documented permission model.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
Confidence
97% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi
Confidence
97% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
Confidence
97% confidence
Finding
sudo -S

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi
Confidence
97% confidence
Finding
sudo -S

Chaining Abuse

High
Category
Tool Misuse
Content
ORIGINAL_COMMAND="$REMOTE_COMMAND"

  # Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
Confidence
95% confidence
Finding
| sudo

Chaining Abuse

High
Category
Tool Misuse
Content
# Wrap command: base64-encode to avoid quote-escaping nightmares.
  # echo '<pass>' | sudo -S -p '' -- sh -c "$(echo '<b64>' | base64 -d)"
  ENCODED_CMD=$(printf '%s' "$REMOTE_COMMAND" | base64 -w0)
  REMOTE_COMMAND="echo '${SUDO_PASS}' | sudo -S -p '' -- sh -c \"\$(echo '${ENCODED_CMD}' | base64 -d)\""
else
  ORIGINAL_COMMAND="$REMOTE_COMMAND"
fi
Confidence
95% confidence
Finding
| sudo

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.