Remotego

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.1.0

Overview

This skill can share your command line over a public link, and its instructions do not add enough safeguards for that level of access.

Install only if you understand that this can make a local terminal reachable from the internet. Avoid running it in privileged shells, production hosts, sensitive repositories, or sessions with secrets; prefer a pinned reviewed package version and run it under a least-privileged account or sandbox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:58

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-68
Vulnerability Type: Unpinned and unverifiable third-party dependency execution
Risk Level: High

Vulnerable Code

markdown

### Install First (if not installed)

```bash
npm install -g @remotego/remotego

Or use without installing:

bash

npx @remotego/remotego bash

text

### Technical Analysis

The instructions install or execute `@remotego/remotego` without specifying an exact version, integrity hash, lockfile, or other provenance verification. Both commands resolve package contents from an external package registry at execution time, allowing the effective code to differ from what was previously reviewed.

The global installation method also persists a package-controlled executable in the user's global npm environment. The `npx` alternative avoids an explicit global installation but still downloads and runs externally supplied package code.

This creates a supply-chain exposure: compromise of the package publisher account, registry, package release process, or a future package version could result in arbitrary code execution on systems following these instructions.

### Attack Path

1. An attacker compromises the package publisher account, release pipeline, or another relevant distribution component.
2. The attacker publishes a malicious version under the same npm package name.
3. A user follows the documented `npm install -g` or `npx` instruction without an exact version or integrity validation.
4. npm retrieves the attacker-controlled release.
5. Package lifecycle scripts or the invoked executable run with the privileges of the user executing the command.
6. The malicious package can access data and perform actions available to that user.

### Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the invoking user. This may expose user-readable files, environment var
...[truncated 355 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific, audited version rather than resolving the latest release.
• Publish and verify cryptographic integrity information for the approved package artifact.
• Provide verifiable source and build provenance for distributed releases.
• Prefer a project-local, locked dependency over global installation.
• Use a lockfile with integrity metadata and a trusted internal registry or package allowlist where appropriate.
• Audit package lifecycle scripts and transitive dependencies before installation.
• Run the package under a dedicated, least-privileged account or sandbox with restricted filesystem, credential, and network access.
• Establish a documented dependency review and update process so version changes require renewed security assessment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:70

Finding

Public Interactive Shell Protected Only by a Bearer Session URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-47 and 70-81
Vulnerability Type: Insufficient authentication for an Internet-exposed interactive terminal
Risk Level: High

Vulnerable Code

markdown

| Goal | Command |
|------|---------|
| Mirror Claude Code | `remotego claude` |
| Mirror bash | `remotego bash` |
| Mirror Python REPL | `remotego python3 -i` |
| Mirror vim | `remotego vim` |
| Mirror Node.js REPL | `remotego node` |
| Custom port | `remotego --port 9000 bash` |
| Custom tunnel domain | `remotego --domain myterm.localhost.run bash` |
| Pass flags to command | `remotego -- git log --oneline` |

markdown

## What Happens

1. Spawns the command in a PTY (pseudo-terminal)
2. Starts a local HTTP server with xterm.js browser terminal
3. Creates a public tunnel via localhost.run
4. Opens the browser automatically with a session URL

## Security Model

- A random session UUID is generated on each start
- The session ID is embedded in the URL — only URL holders can connect
- Clients must authenticate within 5 seconds of connecting

Technical Analysis

The documented workflow permits arbitrary interactive commands, including bash, to be exposed through a public tunnel. Its stated access-control model relies on possession of a random session identifier embedded in the URL.

This is a bearer-token design: anyone who obtains the URL can potentially use the same authority as the intended participant. The documented five-second authentication deadline limits connection timing but does not provide an independent authentication factor when the required credential is the URL itself.

The document does not describe user identity verification, a separate password or cryptographic challenge, explicit host approval for new clients, authorization boundaries, command restrictions, client limits, or reliable session expiration. Session URLs can be unintentionally di ...[truncated 1484 chars]

Remediation

View remediation

Remediation Suggestions

• Require authentication independent of the session URL, such as a short-lived password, OIDC login, or public-key challenge.
• Require explicit approval from the local host before each remote client is admitted.
• Make local-only access the default and require a clear warning and confirmation before creating a public tunnel.
• Apply short expiration periods, one-time credentials, connection limits, and immediate token revocation when a session ends.
• Restrict sessions to an allowlisted command set instead of exposing unrestricted shells by default.
• Run exposed commands in an isolated, least-privileged container or sandbox with minimal filesystem and network access.
• Remove unnecessary credentials and sensitive environment variables before spawning the PTY.
• Prevent session URLs from appearing in persistent logs and warn users not to disclose them through screenshots or public communication channels.
• Display connected-client identity and status, and provide immediate host-controlled disconnection and session termination.
• Use encrypted transport end to end and document the trust assumptions associated with the tunnel provider.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill prominently encourages users to 'share your terminal with anyone over the internet' and 'expose a local CLI to a public URL' without a clear upfront warning that this publishes an interactive local terminal session to the public internet. In this context, users may expose shells, REPLs, editors, credentials, command history, or active working directories, making misuse or accidental disclosure especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation and usage sections provide direct commands for mirroring bash, python3 -i, vim, and similar tools, but omit concrete warnings about the security implications of tunneling those sessions over the internet. The stated 'security model' is weak for such a sensitive capability—URL secrecy and a 5-second authentication window do not meaningfully substitute for strong access controls when a full terminal is being exposed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends running npx @remotego/remotego without pinning a specific version, which allows whatever the latest published package is at execution time to be fetched and run. Because this tool exposes a terminal and creates a public tunnel, a compromised or malicious package update could immediately execute code and expose sensitive local access with little user scrutiny.

Content

No source excerpt is available for this finding.