ClawHub
Back to skill

Security audit

Remoting

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly does what it says, but it exposes an interactive public terminal with weak scoping and mutable package execution, so users should review it carefully before installing.

Install only if you intentionally want a public, interactive terminal session. Use it in a sanitized workspace, avoid displaying secrets, prefer a pinned and reviewed package version, do not share the URL broadly, and stop the session as soon as collaboration is finished.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:28
Finding

Execution of an Unpinned Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-39
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash
# If not already installed
npm install -g @remotego/remotego

# Start mirroring Claude Code
remotego claude
bash
npx @remotego/remotego claude

Technical Analysis

The skill directs users to install or execute @remotego/remotego without specifying an exact version or verifying its integrity and provenance. Both commands resolve a mutable package release from the npm registry. The npx command can download and immediately execute package code, while global installation makes the package persist in the user's global Node.js environment.

The audited project contains no copy of the dependency's source code, package lockfile, integrity hash, or signature. Consequently, the effective code executed by these instructions can differ from the artifact that was reviewed. This does not prove that the current package is malicious, but it creates a supply-chain exposure if a future release, package maintainer account, or registry distribution path is compromised.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or its publication process.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the skill and runs the unversioned npm install -g or npx command.
  4. npm retrieves the mutable malicious release.
  5. Package installation hooks or runtime code execute with the invoking user's permissions.
  6. The payload can access resources available to that user, potentially including project files, environment variables, credentials, and terminal state.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running the command. The accessible scope may include the current project, user-owned files, e ...[truncated 224 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, previously audited version rather than resolving the latest release.
  • Verify npm provenance, publisher identity, and package integrity before execution.
  • Record and validate an expected integrity hash in a reproducible installation process.
  • Avoid global installation; use a dedicated, least-privileged, isolated environment.
  • Disable or carefully control package lifecycle scripts where feasible.
  • Review the package source and transitive dependencies for the pinned release.
  • Document a controlled upgrade process requiring renewed security review before changing versions.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:15
Finding

Public Interactive Terminal Relies on URL Possession for Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-17, 52-63
Vulnerability Type: Insufficient authorization for remote interactive terminal access
Risk Level: High

Vulnerable Code

text
Expose the current Claude Code session as a public web terminal. Anyone with the URL can view and interact with the terminal from their browser.
text
1. Terminal output shows:
   - Local URL: `http://localhost:7681?session=<uuid>`
   - Public URL: `https://xxxxx.lhr.life?session=<uuid>`
2. Browser opens automatically with the public URL
3. Terminal output from Claude Code appears in the browser in real-time
4. Browser users can type and interact with the session
text
- Random session UUID per start — only URL holders can connect
- 5-second auth timeout for new connections

Technical Analysis

The documented access-control model primarily treats possession of a public URL containing a session UUID as authorization. The skill does not document identity-based authentication, explicit local approval for each connection, role separation, a view-only default, or command-level confirmation.

The phrase “5-second auth timeout” does not explain how a viewer's identity is authenticated or what authorization decision occurs. A secret URL may provide entropy, but it remains a bearer credential. It can be exposed through chat messages, screenshots, browser history, clipboard synchronization, logs, or other systems through which the URL is handled.

The remote capability is interactive rather than merely observational: browser users can submit input to the active terminal. This is materially more privileged than the skill's “mirror” or “remote viewing” terminology may suggest.

Attack Path

  1. The user launches the skill, which creates a public terminal URL containing the session identifier.
  2. The URL is intentionally shared with an untrusted recipient or unintentionally leaks t ...[truncated 1107 chars]
Remediation
View remediation

Remediation Suggestions

  • Require identity-based authentication rather than relying solely on possession of a URL.
  • Require explicit local approval for every new remote connection.
  • Use short-lived, single-use session tokens and revoke them immediately after use.
  • Default to view-only access and require a separate, explicit action to enable input.
  • Display a persistent local indicator showing all connected clients and their privileges.
  • Require local confirmation for sensitive commands and file-system operations.
  • Apply least privilege by running the mirrored session in a restricted account, container, or sandbox.
  • Provide immediate client-disconnection and token-revocation controls.
  • Maintain auditable connection and input logs without recording secrets.
  • Clearly warn users that anyone with interactive access may affect the active session.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:60
Finding

Cached Terminal History Is Disclosed to New Viewers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60-64
Vulnerability Type: Excessive retention and disclosure of terminal output
Risk Level: Medium

Vulnerable Code

text
## Security

- Random session UUID per start — only URL holders can connect
- 5-second auth timeout for new connections
- All output is cached so new viewers see full history

Technical Analysis

The service is described as caching all terminal output and automatically presenting the complete history to newly connected viewers. No retention boundary, secret redaction, encryption policy, per-viewer authorization, or user confirmation before historical disclosure is documented.

Terminal output can contain sensitive source code, file paths, command arguments, error messages, environment data, credentials printed by tools, and prior agent conversation content. Allowing a new viewer to retrieve output generated before that viewer connected increases both the amount of exposed information and the duration of exposure.

Attack Path

  1. The local terminal emits sensitive information during the mirrored session.
  2. The remoting service caches the output as part of the full terminal history.
  3. The public session URL is shared with or obtained by another party.
  4. That party connects after the sensitive output was originally displayed.
  5. The service sends the cached history to the new viewer.
  6. The viewer extracts sensitive project information or credentials from the historical output.

Impact Assessment

Exploitation can disclose all terminal output retained for the session, including data generated before the viewer connected. Depending on terminal activity, this may expose proprietary source code, secrets, internal paths, operational details, and agent context. If usable credentials appear in the output, the disclosure could facilitate access to external systems within the privileges granted by those credentials.

Remediation
View remediation

Remediation Suggestions

  • Disable historical-output caching by default.
  • Require explicit local consent before sharing output produced before a viewer connected.
  • Apply strict retention limits and securely clear buffers when a session ends.
  • Redact common secret formats, tokens, credentials, and sensitive environment values.
  • Allow users to clear the history before generating or sharing a remote URL.
  • Separate live viewing from historical replay and authorize those capabilities independently.
  • Encrypt retained output and ensure it is accessible only to authenticated, authorized viewers.
  • Warn users not to display secrets while remote sharing is active.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill presents public terminal sharing as a convenience feature without a prominent warning that it creates an internet-accessible interactive session. In this context, omitting privacy and integrity warnings is especially dangerous because terminal contents may include secrets, and connected users can actively type commands that affect the host environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match common collaboration or viewing requests, which increases the chance the agent invokes this skill in situations where the user did not intend to create a public interactive terminal. Because the skill grants remote browser users the ability to view and interact with the terminal, accidental activation can expose sensitive data and allow unintended command input.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to execute an unpinned package directly via npx, which fetches and runs whatever version is currently published under that package name. In a skill whose purpose is to expose a live interactive terminal, any upstream package compromise or malicious update could immediately yield arbitrary code execution and public terminal exposure on the user's machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.