T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:111- Finding
Persistent SSH Exposure and Authentication Key Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Remote Copy
Security checks for vulnerabilities and agentic risk
Overview
This remote-copy skill is understandable, but it teaches insecure SSH practices and persistent system changes that users should review before installing.
Install only if you are comfortable reviewing every SSH command before it runs. Avoid using the password example, do not disable host-key verification unless you have independently verified the server, and do not let the skill permanently enable SSH, open firewall rules, or add keys unless you explicitly intend that long-term access.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:75- Finding
SSH Host Authentication Disabled During File Transfers
- Content
View full analysis
nul && cd /d "{remote_path}" && tar cf - .' | tar xf - -C {local_dest} ``` ```bash sshpass -p "{password}" scp -r -o StrictHostKeyChecking=no {user}@{ip}:"{path}" {local_dest} ``` ```bash rsync -avz --progress -e "ssh -o StrictHostKeyChecking=no" {user}@{ip}:"{path}" {local_dest} ``` The troubleshooting table also recommends: ```text Host key verification failed | First connection not trusted | Add -o StrictHostKeyChecking=no ``` ### Technical Analysis SSH host keys authenticate the remote server and protect against server impersonation. `StrictHostKeyChecking=no` suppresses the normal trust decision and is used throughout the documented SCP, SSH, password, and rsync workflows. As a result, the transfer process may connect to an attacker-controlled server when traffic is redirected or intercepted. The option is presented as a normal solution to host-key failures rather than a narrowly controlled bootstrap action with independent fingerprint validation. This is especially dangerous in the password workflow because the user can submit credentials to an impersonated SSH endpoint. For download operations, an impersonated endpoint can also provide attacker-selected files that the operator may subsequently trust or execute. ### Attack Path 1. An attacker obtains a position capable of redirecting the SSH connection, such as through ARP spoofing, routing manipulation, or control of the destination address. 2. The attacker presents an arbitrary SSH host key. 3. The Skill connects with `StrictHostKeyChecking=no`, so the expected server identity is not reliably validate ...[truncated 888 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:75- Finding
Plaintext Password Exposure and Unsafe Shell Interpolation
- Content
View full analysis
nul && cd /d "{remote_path}" && tar cf - .' | tar xf - -C {local_dest} ``` ```bash sshpass -p "{password}" scp -r -o StrictHostKeyChecking=no {user}@{ip}:"{path}" {local_dest} ``` ```bash rsync -avz --progress -e "ssh -o StrictHostKeyChecking=no" {user}@{ip}:"{path}" {local_dest} ``` ### Technical Analysis The `sshpass -p` option supplies the password directly in the command invocation. Depending on the operating system, execution environment, logging, and process-monitoring controls, command-line secrets may be exposed to process inspection, shell history, audit records, diagnostic output, or Agent logs. The statement that the password is not saved does not address these transient but observable disclosure channels. The command templates also interpolate values derived from user input, including `{local_dest}`, `{user}`, `{ip}`, `{remote_path}`, `{converted_path}`, and `{path}`, into shell commands. The documentation does not define validation, escaping, or subprocess argument-array handling. Notably, `{local_dest}` is unquoted in `mkdir`, SCP, and the tar extraction command. A destination containing shell separators, substitutions, redirections, or whitespace can change command interpretation. The remote command also inserts `{remote_path}` into a shell command, creating local or remote injection risk if quote or command-substitution syntax reaches the shell unchanged. ### Attack Path 1. An attacker persuades a user to request a transfer using a crafted path, destination, username, or host value. 2. The Agent substitutes that value into one o ...[truncated 1585 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Ubuntu/Debian：
bash sudo apt update && sudo apt install openssh-server -y sudo systemctl start sshd sudo systemctl enable sshd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
首次连接后配置密钥免密：
bash # 生成密钥（如果没有） ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N "" # 复制公钥到远程 ssh-copy-id -i ~/.ssh/id_ed25519.pub {user}@{ip}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
首次连接后配置密钥免密：
bash # 生成密钥（如果没有） ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N "" # 复制公钥到远程 ssh-copy-id -i ~/.ssh/id_ed25519.pub {user}@{ip}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The transfer commands disable SSH host key verification with StrictHostKeyChecking=no without a strong warning, which removes protection against man-in-the-middle attacks and host impersonation. In a remote copy skill, this is particularly dangerous because users may transfer sensitive files to or from an attacker-controlled host while believing the SSH connection is trustworthy.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
图形界面：系统设置 → 通用 → 共享 → 远程登录 → 打开
命令行：
sudo systemsetup -setremotelogin on
text **验证：**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash sudo apt update && sudo apt install openssh-server -y sudo systemctl start sshd sudo systemctl enable sshdCentOS/RHEL/Rocky：
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash sudo apt update && sudo apt install openssh-server -y sudo systemctl start sshd sudo systemctl enable sshdCentOS/RHEL/Rocky：
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly supports password-based authentication via sshpass, which places credentials on the command line and exposes them to shell history, process listings, logs, and other local observers. This expands the skill from simple file copy into credential handling and increases the chance of secret disclosure during routine use.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill performs recursive copy into local destinations after creating directories, but it does not clearly warn users that files may be created or overwritten locally. This can cause unintended data loss or confusion, especially when default destination paths or repeated transfers are used.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill is described as copying files from a remote machine to the local Mac, but this section states it may optionally open the destination in Finder. Launching local GUI applications is a separate capability that is not necessary to accomplish the transfer itself.
- Content
Static analysis
No suspicious patterns detected.