ClawHub
Back to skill

Security audit

ssh_file_manager

Security checks for vulnerabilities and agentic risk

Overview

The skill openly manages files over Tailscale SSH, but it gives an agent broad remote and local file-control power with weak built-in guardrails.

Install only if you intentionally want an agent to manage files across your Tailnet using your SSH privileges. Verify the exact host and path before every operation, use a limited SSH identity where possible, avoid running it against privileged system paths, and treat pull/push/delete/chmod as high-risk until the helper adds path restrictions, overwrite protection, and enforced confirmations.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
command,
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, input=stdin)
        return result.returncode, result.stdout, result.stderr
    except subprocess.TimeoutExpired:
        return -1, "", "SSH connection timed out"
Confidence
96% confidence
Finding
This subprocess call executes SSH with a remote shell command string built from user-controlled inputs such as host, path, mode, and search name. Although shell=False prevents local shell injection, the remote side still interprets the command via a shell, and the custom escaping is incomplete in places, enabling command injection or unintended command execution on the remote host.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
dst,
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode, result.stdout, result.stderr
    except subprocess.TimeoutExpired:
        return -1, "", "SCP connection timed out"
Confidence
85% confidence
Finding
This subprocess call invokes scp using src/dst values that embed user-controlled host and path data in scp's own remote-path syntax. Because scp interprets remote specifications specially and historically delegates parts to remote shell behavior, insufficient validation can lead to argument confusion, unexpected file overwrite/transfer targets, or unsafe interaction with malicious endpoints.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to invoke local shell commands (`python3 ...`, `ssh`, `scp`, `sftp`) and perform remote file operations, yet it declares no permissions. This creates a hidden capability boundary issue: callers, reviewers, or policy systems may treat the skill as low-risk while it can read files and execute shell-driven remote actions that may modify or exfiltrate data across tailnet hosts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The pull action writes attacker-controlled remote content directly to an arbitrary local path supplied by the caller, with no path restrictions or overwrite protections. In an agent context, a malicious or compromised remote host could cause sensitive local files to be overwritten or plant files in privileged locations, making this more dangerous than a mere missing warning.

Static analysis

No suspicious patterns detected.