ClawHub
Back to skill

Security audit

Windows Remote

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Windows SSH administration tool, but its default SSH/SCP settings disable host verification for powerful remote command and file-transfer operations.

Review before installing. Use this only for Windows hosts you administer, with a restricted SSH account and a dedicated key. Pin or pre-provision the Windows host key instead of accepting StrictHostKeyChecking=no, and carefully confirm any command, upload path, or download destination before invoking the scripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/win-exec.sh:22
Finding

SSH Host Authentication Disabled for Remote Command Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/win-upload.sh:22
Finding

SSH Host Authentication Disabled During File Upload

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/win-download.sh:22
Finding

SSH Host Authentication Disabled During File Download

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
"example": "Administrator"
          },
          "WINDOWS_SSH_KEY": {
            "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)",
            "required": false,
            "default": "~/.ssh/id_ed25519"
          },

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
"example": "Administrator"
          },
          "WINDOWS_SSH_KEY": {
            "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)",
            "required": false,
            "default": "~/.ssh/id_ed25519"
          },

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
| Issue | Solution |
|-------|----------|
| Connection refused | Check SSH service: `Get-Service sshd` |
| Permission denied | Verify SSH key in `~/.ssh/authorized_keys` or `administrators_authorized_keys` |
| Timeout | Check firewall rules, verify IP/port |
| Command not found | Use full path or check PATH on Windows |

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/win-download.sh (reported line 10)May include surrounding context.

sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/win-exec.sh (reported line 11)May include surrounding context.

sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/win-upload.sh (reported line 10)May include surrounding context.

sh
HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match generic requests like 'execute on remote' or 'check GPU', which could cause this high-impact remote-execution skill to activate outside a clearly intended Windows administration context. Because the skill enables command execution and file transfer to remote hosts, accidental invocation materially increases the chance of unintended actions on infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents remote command execution, uploads/downloads, and service control without prominently warning that these actions can modify systems, disrupt services, or overwrite data. In an agent context, missing safety guidance increases the risk that users or downstream automation invoke powerful operations without appreciating their operational impact.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
## Security Notes

- Use SSH keys instead of passwords
- Keep private keys secure (chmod 600)
- Consider using Tailscale for cross-network access

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script implements SCP download functionality from a remote Windows host, but the skill metadata describes remote command execution and system management without clearly disclosing file exfiltration/download behavior. Hidden or undocumented transfer capability expands the effective privilege/scope of the skill and can mislead users or policy controls about what data movement is possible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Disabling StrictHostKeyChecking causes the client to accept unknown or changed SSH host keys without validation, enabling man-in-the-middle interception or redirection to an attacker-controlled host. In a file download workflow, this can result in silent retrieval of tampered files or disclosure of credentials and connection metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script executes an arbitrary command on a remote Windows host via SSH, which is a safety-critical subprocess/network operation. While the file has brief comments describing usage, it provides no confirmation prompt, visible runtime disclosure, or explicit warning about executing the supplied command on the remote system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes this skill as controlling remote Windows machines via SSH for executing commands, checking GPU status, running scripts, and managing systems. This script performs SCP-based file transfer, which is a distinct capability not mentioned in the manifest description and goes beyond the specifically claimed operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script will transmit any caller-supplied local file to a remote host immediately, with no confirmation, preview, or policy checks. In an agent context, this increases the risk of unintended exfiltration of sensitive local files if the tool is invoked with unsafe arguments or by a compromised workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.