Windows Remote

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:59 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Windows SSH administration tool, but its default SSH/SCP settings disable host verification for powerful remote command and file-transfer operations.

Review before installing. Use this only for Windows hosts you administer, with a restricted SSH account and a dedicated key. Pin or pre-provision the Windows host key instead of accepting StrictHostKeyChecking=no, and carefully confirm any command, upload path, or download destination before invoking the scripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/win-exec.sh:22
• Finding: SSH Host Authentication Disabled for Remote Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/win-exec.sh:19-24` **Vulnerability Type**: Disabled SSH host-key verification **Risk Level**: Medium ### Vulnerable Code ```bash SSH_OPTS=( -o "ConnectTimeout=$TIMEOUT" -o "StrictHostKeyChecking=no" -o "BatchMode=yes" -p "$PORT" ) ``` ### Technical Analysis The script unconditionally passes `StrictHostKeyChecking=no` to the SSH client. This causes SSH to accept a host key that has not been trusted in advance, preventing reliable authentication of the configured Windows endpoint. SSH public-key authentication may still authenticate the client without revealing the private key, but it does not compensate for the loss of server authentication. An attacker capable of redirecting or intercepting the connection could impersonate the remote Windows host and receive commands intended for it or return forged command output. The use of an SSH private key is consistent with the Skill's declared remote-administration functionality and does not itself exceed minimum privileges. The script checks for the key and passes its path to SSH; it does not directly read, modify, print, or transmit the private-key contents. ### Attack Path 1. A user configures `WINDOWS_SSH_HOST` and invokes `win-exec.sh`. 2. An attacker gains a network interception position or redirects the hostname through DNS, routing, or local-network manipulation. 3. The attacker's SSH server presents an untrusted host key. 4. `StrictHostKeyChecking=no` allows the connection to continue without rejecting the unknown identity. 5. The script sends the caller-supplied remote command to the impersonating server. 6. The attacker observes the command and returns attacker-controlled output, which may mislead subsequent users or automation. ### Impact Assessment A successful attacker can compromise the confidentiality and integrity of commands and command results for affected SSH sessions. The attacker can learn operational details i ...[truncated 308 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `-o "StrictHostKeyChecking=no"`. - Require strict host authentication with `-o "StrictHostKeyChecking=yes"`. - Provision the expected Windows SSH host key through a trusted, out-of-band process before the first connection. - Consider using a Skill-specific known-hosts file, for example: ```bash SSH_OPTS=( -o "ConnectTimeout=$TIMEOUT" -o "StrictHostKeyChecking=yes" -o "UserKnownHostsFile=${WINDOWS_SSH_KNOWN_HOSTS:-$HOME/.ssh/known_hosts}" -o "BatchMode=yes" -p "$PORT" ) ``` - Document how administrators can verify the host-key fingerprint directly on the Windows server. - Do not automatically trust output from an unauthenticated `ssh-keyscan` operation; verify the resulting fingerprint over a separate trusted channel. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/win-upload.sh:22
• Finding: SSH Host Authentication Disabled During File Upload<![CDATA[ ## Vulnerability Details **File Location**: `scripts/win-upload.sh:20-24` **Vulnerability Type**: Disabled SCP/SSH host-key verification **Risk Level**: Medium ### Vulnerable Code ```bash SCP_OPTS=( -o "ConnectTimeout=$TIMEOUT" -o "StrictHostKeyChecking=no" -P "$PORT" ) ``` ### Technical Analysis The upload script disables SSH host-key verification for every SCP connection. Consequently, it does not reliably verify that the destination is the configured Windows machine. An attacker who can intercept or redirect the connection can present an arbitrary SSH host key. Because the script automatically accepts that key, the uploaded file may be delivered to an attacker-controlled server rather than the intended destination. The optional access to `$HOME/.ssh/id_ed25519` is necessary for the documented SSH authentication function. The script only checks whether the key path exists and delegates authentication to SCP; no direct key-file modification or secret exfiltration was identified. ### Attack Path 1. A caller invokes `win-upload.sh` with a local file and remote path. 2. An attacker manipulates DNS, routing, or local-network traffic for `WINDOWS_SSH_HOST`. 3. The attacker presents a previously unknown SSH host key. 4. The SCP client accepts the key because strict checking is disabled. 5. The local file is uploaded to the attacker's server. 6. The script prints a success message identifying the configured host, potentially causing the caller to believe the intended Windows system received the file. ### Impact Assessment A successful attacker can obtain the complete contents of files selected for upload. The practical severity depends on the sensitivity of those files and the caller's choice of source path. The attacker may also prevent the intended remote host from receiving the file, compromising availability and deployment integrity. This issue does not automatically permit reading arbitrary local files: the caller must supply th ...[truncated 83 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `-o "StrictHostKeyChecking=no"`. - Use `StrictHostKeyChecking=yes` and a pre-provisioned known-hosts file. - Permit a dedicated known-hosts path through a validated configuration variable if isolation from the user's general SSH configuration is desired. - Verify and pin the Windows server's SSH host-key fingerprint through a trusted administrative channel. - Fail closed when the host key is absent or changes unexpectedly. - Only print a successful upload message after SCP exits successfully, as the script currently does through `set -e`, but ensure that success is tied to an authenticated server identity. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/win-download.sh:22
• Finding: SSH Host Authentication Disabled During File Download<![CDATA[ ## Vulnerability Details **File Location**: `scripts/win-download.sh:20-24` **Vulnerability Type**: Disabled SCP/SSH host-key verification **Risk Level**: Medium ### Vulnerable Code ```bash SCP_OPTS=( -o "ConnectTimeout=$TIMEOUT" -o "StrictHostKeyChecking=no" -P "$PORT" ) ``` ### Technical Analysis The download script accepts untrusted SSH host keys, so it cannot reliably establish that downloaded content originates from the configured Windows machine. An attacker capable of redirecting or intercepting the connection may impersonate the server and return attacker-controlled data. The downloaded content is written to the caller-selected local path, which creates an integrity risk and can become more severe if subsequent automation executes, imports, parses, or deploys that file. The configured private-key access is aligned with the declared SCP functionality. The script neither writes to SSH key files nor exposes private-key contents. The documentation reference to `authorized_keys` is troubleshooting advice rather than a file-write operation. ### Attack Path 1. A caller invokes `win-download.sh` with a remote source and local destination. 2. An attacker redirects or intercepts traffic to `WINDOWS_SSH_HOST`. 3. The attacker's SSH server presents an untrusted host key. 4. The script accepts the key because `StrictHostKeyChecking` is disabled. 5. The attacker supplies forged content as the requested remote file. 6. SCP writes that content to the local path chosen by the caller. 7. If the downloaded file is later executed or consumed by trusted automation, the attacker-controlled content may produce downstream code execution or data corruption. ### Impact Assessment The direct impact is loss of integrity and authenticity for downloaded files. The attacker can substitute arbitrary content for the requested file and prevent retrieval of the genuine remote data. The script does not itself execute downloaded content, so downstream code ...[truncated 227 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `-o "StrictHostKeyChecking=no"`. - Enforce `StrictHostKeyChecking=yes`. - Use a managed known-hosts file containing a verified key for the Windows server. - Treat an absent or changed host key as a fatal error requiring explicit administrative review. - For sensitive artifacts, add independent integrity verification, such as a trusted checksum or digital signature, after download. - Avoid automatically executing or importing downloaded files unless their provenance and integrity have been verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Credential Access

High

• Category: Privilege Escalation

Content

"example": "Administrator"
          },
          "WINDOWS_SSH_KEY": {
            "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)",
            "required": false,
            "default": "~/.ssh/id_ed25519"
          },

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"example": "Administrator"
          },
          "WINDOWS_SSH_KEY": {
            "description": "Path to SSH private key (default: ~/.ssh/id_ed25519)",
            "required": false,
            "default": "~/.ssh/id_ed25519"
          },

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Issue | Solution |
|-------|----------|
| Connection refused | Check SSH service: `Get-Service sshd` |
| Permission denied | Verify SSH key in `~/.ssh/authorized_keys` or `administrators_authorized_keys` |
| Timeout | Check firewall rules, verify IP/port |
| Command not found | Use full path or check PATH on Windows |

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

HOST="${WINDOWS_SSH_HOST:?WINDOWS_SSH_HOST is required}"
PORT="${WINDOWS_SSH_PORT:-22}"
USER="${WINDOWS_SSH_USER:?WINDOWS_SSH_USER is required}"
KEY="${WINDOWS_SSH_KEY:-$HOME/.ssh/id_ed25519}"
TIMEOUT="${WINDOWS_SSH_TIMEOUT:-10}"

if [ -z "$1" ] || [ -z "$2" ]; then

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match generic requests like 'execute on remote' or 'check GPU', which could cause this high-impact remote-execution skill to activate outside a clearly intended Windows administration context. Because the skill enables command execution and file transfer to remote hosts, accidental invocation materially increases the chance of unintended actions on infrastructure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents remote command execution, uploads/downloads, and service control without prominently warning that these actions can modify systems, disrupt services, or overwrite data. In an agent context, missing safety guidance increases the risk that users or downstream automation invoke powerful operations without appreciating their operational impact.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Security Notes

- Use SSH keys instead of passwords
- Keep private keys secure (chmod 600)
- Consider using Tailscale for cross-network access

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script implements SCP download functionality from a remote Windows host, but the skill metadata describes remote command execution and system management without clearly disclosing file exfiltration/download behavior. Hidden or undocumented transfer capability expands the effective privilege/scope of the skill and can mislead users or policy controls about what data movement is possible.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Disabling StrictHostKeyChecking causes the client to accept unknown or changed SSH host keys without validation, enabling man-in-the-middle interception or redirection to an attacker-controlled host. In a file download workflow, this can result in silent retrieval of tampered files or disclosure of credentials and connection metadata.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script executes an arbitrary command on a remote Windows host via SSH, which is a safety-critical subprocess/network operation. While the file has brief comments describing usage, it provides no confirmation prompt, visible runtime disclosure, or explicit warning about executing the supplied command on the remote system.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest describes this skill as controlling remote Windows machines via SSH for executing commands, checking GPU status, running scripts, and managing systems. This script performs SCP-based file transfer, which is a distinct capability not mentioned in the manifest description and goes beyond the specifically claimed operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script will transmit any caller-supplied local file to a remote host immediately, with no confirmation, preview, or policy checks. In an agent context, this increases the risk of unintended exfiltration of sensitive local files if the tool is invoked with unsafe arguments or by a compromised workflow.

Static analysis

No suspicious patterns detected.