Security audit

Ssh Batch Manager

Security checks for vulnerabilities and agentic risk

Overview

This SSH management skill is mostly purpose-aligned, but it installs a persistent network service and handles SSH credentials and server access with unsafe scoping that users should review carefully.

Install only if you intend to grant this skill administrative control over SSH access on the configured servers. Review the post-install service first, prefer disabling the auto-start web service, bind any UI to loopback only, avoid password-based SSH where possible, verify host keys, and test on non-production targets before using enable-all or disable-all.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: ssh-manager.en.html:360
Finding: Shell Command Injection Through Web UI Configuration Serialization
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: ssh-manager.en.html:174
Finding: Stored Cross-Site Scripting in the Privileged Server List
Content: View full analysis
` ${server.user}@${server.host} ${server.user} ${server.host}:${server.port || 22} ${server.auth === 'key' ? '🔑 Key' : '🔒 Password'} Configured Enable Disable Delete `).join(''); } ``` ### Technical Analysis Configuration values are inserted directly into `innerHTML` and inline event-handler attributes without HTML or JavaScript-context escaping. A crafted `server.user`, ...[truncated 1580 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: serve-ui.py:39
Finding: Web UI Server Exposed on All Network Interfaces Without Authentication
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: post-install.sh:33
Finding: Automatic Installation of a System-Wide Persistent Web Service
Content: View full analysis
/dev/null << EOF [Unit] Description=SSH Batch Manager Web UI Documentation=https://gitee.com/subline/onepeace/tree/develop/src/skills/ssh-batch-manager After=network.target [Service] Type=simple User=${USER} Group=${USER} WorkingDirectory=${SKILL_DIR} ExecStart=/usr/bin/python3 ${SKILL_DIR}/serve-ui.py Restart=on-failure RestartSec=5 StandardOutput=journal StandardError=journal SyslogIdentifier=ssh-batch-ui # Security settings NoNewPrivileges=true PrivateTmp=true [Install] WantedBy=multi-user.target EOF # Reload systemd sudo systemctl daemon-reload # Enable service (start on boot) sudo systemctl enable ${SERVICE_NAME} # Start service sudo systemctl start ${SERVICE_NAME} ``` ### Technical Analysis The post-install script uses `sudo` to write a system-wide unit under `/etc/systemd/system`, enables it for startup, and starts it immediately. This makes the Web UI survive reboots and future sessions. The persistence is disclosed in the Skill documentation, so it is not hidden. Nevertheless, it exceeds the minimum privileges required for the core SSH batch-management CLI and is installed as part of the normal installation flow. Its risk is amplified because `serve-ui.py` listens on all interfaces and provides no authentication. `NoNewPrivileges=true` and execution as the installing user reduce some privilege-escalation risk, but they do not remove the persistent network attack surface or the root-level modification of system service configuration. ### Attack Path 1. The user installs the Skill and allows the post-install script to run. 2. The script requests elevated privileges through `sudo`. 3. A unit is written to `/etc/systemd/system/ssh-batch-ui.service`. 4. `systemctl enable` registers the service to start at boot. 5. `syst ...[truncated 709 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: ssh-batch-manager.py:181
Finding: SSH Host Authentication Disabled During Credentialed Operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: ssh-batch-manager.py:782
Finding: Sensitive Passwords and Encryption Keys Exposed Through Process Arguments and Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (191)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Appending a key to ~/.ssh/authorized_keys is a credential and persistence action because it modifies who can authenticate to the account. In this context the feature is intentional, but if the wrong key, host, or account is targeted, it silently establishes durable remote access across systems.
Content: Scanner excerpt · CHANGELOG-v2.1.md (reported line 48)May include surrounding context.
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip()

source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

text
**效果**:

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 96% confidence
Finding: The YARA rule matched because the documented command performs SSH key injection into authorized_keys, a classic persistence mechanism also used by attackers. Even though the apparent product intent is legitimate batch administration, the exact behavior is security-sensitive and especially dangerous here because the changelog shows use on multiple production servers and root accounts.
Content: Scanner excerpt · CHANGELOG-v2.1.md (reported line 48)May include surrounding context.
�能免密登录，跳过

text
--- ### 2️⃣ 来源标识 **问题**: 无法区分公钥是从哪台服务器分发的。 **解决**: 在 authorized_keys 中添加来源标识注释。 **实现**: ```python SOURCE_IDENTIFIER = "ssh-batch-manager" SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

效果:

text
# authorized_keys 内容 ssh-ed25519 AAAAC3... ssh-batch-manager from mls at 2026-03-03 17:30:00

优势:

✅ 知道是哪台服务器分发的

✅ 知道分发时间

✅ 便于审计和清理

3️⃣ 配置清理

问题: 测试配置和生产配置混在一起。

解决: 删除测试服务器，只保留生产服务器。

清理的服务器:

❌ root@10.0.0.2 (测试)

❌ user1@10.8.8.1 (测试)

保留的服务器:

✅ 10.8.8.81

✅ 10.8.8.85

✅ 10.8.8.86

�

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG-v2.1.md (reported line 175)May include surrounding context.
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip()

source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

text
**Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.en.md (reported line 45)May include surrounding context.
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip()

source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

text
**Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.en.md (reported line 172)May include surrounding context.
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip()

source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

text
**Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.en.py (reported line 390)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.en.py (reported line 434)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 234)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 360)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 390)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 434)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 573)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 588)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 606)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 625)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 668)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 684)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 697)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ssh-batch-manager.py (reported line 717)May include surrounding context.
python
SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys' ``` **Effect**:

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: Appending directly to ~/.ssh/authorized_keys is a persistence mechanism and is inherently high risk because it grants or maintains SSH access on remote systems. In this skill's context, that behavior is the advertised purpose, which makes it less indicative of malware intent, but the shell-based construction shown is still dangerous because misuse, mis-targeting, or command injection through unescaped key/comment data could lead to unauthorized access or account compromise across multiple servers.
Content: Scanner excerpt · CHANGELOG.en.md (reported line 45)May include surrounding context.
g

text
--- #### 2️⃣ Source Identifier **Problem**: Cannot distinguish which server distributed the public key. **Solution**: Add source identifier comment to authorized_keys. **Implementation**: ```python SOURCE_IDENTIFIER = "ssh-batch-manager" SOURCE_HOST = subprocess.run(['hostname'], ...).stdout.strip() source_comment = f" {SOURCE_IDENTIFIER} from {SOURCE_HOST} at {timestamp}" cmd = f'echo "{pub_key}{source_comment}" >> ~/.ssh/authorized_keys'

Effect:

text
# authorized_keys content ssh-ed25519 AAAAC3... ssh-batch-manager from mls at 2026-03-03 17:30:00

Benefits:

✅ Know which server distributed the key

✅ Know distribution timestamp

✅ Easy to audit and cleanup

3️⃣ Configuration Cleanup

Problem: Test and production configurations mixed together.

Solution: Delete test servers, keep only production servers.

Deleted servers:

❌ root@10.0.0.2 (test)

❌ user1@10.8.8.1 (test)

Retained servers:

✅ 10.8.8.81

�

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill primarily launches a local web UI and does not actually perform multi-server SSH management, connectivity checks, or source tracking, the mismatch is severe because it misrepresents both functionality and risk. Such deception can cause users to expose credentials and install persistence without obtaining the promised security or operational benefit.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill primarily launches a local web UI and does not actually perform multi-server SSH management, connectivity checks, or source tracking, the mismatch is severe because it misrepresents both functionality and risk. Such deception can cause users to expose credentials and install persistence without obtaining the promised security or operational benefit.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill primarily launches a local web UI and does not actually perform multi-server SSH management, connectivity checks, or source tracking, the mismatch is severe because it misrepresents both functionality and risk. Such deception can cause users to expose credentials and install persistence without obtaining the promised security or operational benefit.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill primarily launches a local web UI and does not actually perform multi-server SSH management, connectivity checks, or source tracking, the mismatch is severe because it misrepresents both functionality and risk. Such deception can cause users to expose credentials and install persistence without obtaining the promised security or operational benefit.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill primarily launches a local web UI and does not actually perform multi-server SSH management, connectivity checks, or source tracking, the mismatch is severe because it misrepresents both functionality and risk. Such deception can cause users to expose credentials and install persistence without obtaining the promised security or operational benefit.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

T09 · Insecure Skill Coding Practices

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3️⃣ 配置清理

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3️⃣ Configuration Cleanup

Tp4

Tp4

Tp4

Tp4

Tp4