ClawHub
Back to skill

Security audit

BilldDesk Remote Desktop

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent remote-desktop documentation, but it includes unsafe installation guidance that can execute changing remote code and start an unverified container service.

Review carefully before installing. Prefer official platform installers or package-manager instructions over curl-to-shell, verify any server container image by official registry and digest, bind private deployment ports only to trusted interfaces, and enable unattended access, clipboard sync, file transfer, and bulk control only for devices you own or administer with strong authentication.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:115
Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:150
Finding

Deployment Uses an Unqualified Container Image with a Mutable Latest Tag

Content
View full analysis
Remediation
View remediation
``` - Publish the expected digest through an authenticated release channel and document how users can verify image signatures and provenance. - Use signed images and enforce signature verification where the container tooling supports it. - Bind ports to a specific trusted interface, such as localhost, unless public exposure is explicitly required. - Document firewall and authentication requirements before exposing either service. - Apply runtime hardening where compatible, including a non-root container user, dropped Linux capabilities, a read-only root filesystem, resource limits, and `no-new-privileges`. - Avoid `latest` in production deployment instructions. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to fetch and immediately execute a remote shell script with curl ... | sh. If the remote server, transport path, or hosted script is compromised, arbitrary code will run on the user's machine without inspection, making this a classic supply-chain and remote-code-execution risk.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

  1. 安装 Tailscale
bash
# Linux
curl -fsSL https://tailscale.com/install.sh | sh

# Windows: https://tailscale.com/download
# macOS: App Store

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh pipeline is dangerous because it executes network-retrieved content directly in a shell, preventing review and magnifying the impact of any compromise of the source or TLS trust chain. In this skill's context, which already encourages installing remote-access tooling, this pattern increases the risk of users granting attackers immediate code execution on systems that may later be used for remote administration.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

  1. 安装 Tailscale
bash
# Linux
curl -fsSL https://tailscale.com/install.sh | sh

# Windows: https://tailscale.com/download
# macOS: App Store

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill promotes remote-control capabilities such as file transfer, clipboard sync, unattended startup, and batch control, but does not prominently warn that using these features can modify system state, expose sensitive data, or disrupt the controlled device. In a remote-desktop skill, omission of a clear warning increases the chance of unsafe use and social-engineering abuse because users may not appreciate the level of access being granted.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.