ClawHub
Back to skill

Security audit

SSH Server

Security checks for vulnerabilities and agentic risk

Overview

This SSH administration skill is mostly coherent, but it recommends an unsafe SSH connection option that can expose users to server impersonation and credential theft.

Review before installing. Do not use the documented `StrictHostKeyChecking=no` SSH command; verify and pin host keys instead. Prefer SSH keys over saved passwords, avoid direct root login where possible, and only run sudo, service restart/stop, Docker, or log commands on servers you control after confirming the target and impact.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:62
Finding

SSH Host Key Verification Is Explicitly Disabled

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: SSH host impersonation and man-in-the-middle exposure
Risk Level: High

Vulnerable code snippet:

bash
ssh -o StrictHostKeyChecking=no user@your-server-ip

Technical Analysis

The documented SSH command sets StrictHostKeyChecking=no. This causes the SSH client to accept an unrecognized host key without requiring the user to verify its fingerprint.

SSH host-key validation authenticates the remote server before credentials or commands are exchanged. Disabling strict validation removes this protection for first-time or otherwise untrusted connections. An attacker capable of redirecting network traffic can present an attacker-controlled SSH server, and the client will proceed without warning the user that the server identity has not been verified.

Although SSH still encrypts the transport, that encryption terminates at the attacker's impersonating server. If password authentication is used as recommended elsewhere in the documentation, the user may disclose the server password to the attacker. The attacker can also display fabricated command output or proxy the session to the legitimate server.

Attack Path

  1. A user follows the documented command to connect to a server.
  2. An attacker gains a traffic-redirection position through a compromised gateway, rogue wireless network, DNS poisoning, routing manipulation, or modification of the destination IP.
  3. The attacker operates an SSH server and presents an arbitrary host key.
  4. Because StrictHostKeyChecking=no is enabled, the client accepts the unverified key without requiring fingerprint confirmation.
  5. The user authenticates to the impersonating server.
  6. With password authentication, the attacker-controlled endpoint can capture the submitted password.
  7. The attacker may use the captured credentials against the legitimate server, subject to network reachabili ...[truncated 964 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the option that disables host-key verification:

    bash
    ssh user@your-server-ip

  2. Before the first connection, obtain the server's SSH host-key fingerprint through a trusted, independent channel such as the cloud provider console or an authenticated administrator.

  3. Compare the displayed fingerprint with the trusted fingerprint before accepting and storing the key.

  4. For automated use, provision a verified host key in known_hosts and require strict checking:

    bash
    ssh -o StrictHostKeyChecking=yes user@your-server-ip

  5. Do not rely on unauthenticated ssh-keyscan output alone. If it is used to collect a key, verify the resulting fingerprint independently before trusting it.

  6. Prefer SSH public-key authentication, disable password authentication where operationally possible, avoid direct root login, and grant only the minimum required permissions.

  7. Update all documentation and examples so they never recommend bypassing SSH server identity verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command explicitly disables SSH host key checking, which defeats server identity verification and makes man-in-the-middle attacks substantially easier. Users following this guidance may connect to an attacker-controlled host and disclose credentials or execute sensitive operations on the wrong system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document title, instructions, and warnings are all presented in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README asserts that dangerous operations will require confirmation, but the documented capability set includes privileged and potentially disruptive commands without any evidence that confirmations are actually enforced by the skill. This can create a false sense of safety, leading users to authorize administrative actions under incorrect assumptions about guardrails.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 76)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README_EN.md (reported line 63)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README_EN.md (reported line 75)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README_EN.md (reported line 76)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

Service Management

bash
systemctl status nginx
sudo systemctl restart nginx

Docker Operations

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation conditions are broad enough that the skill may be invoked for many generic server-related requests, increasing the chance the agent proposes SSH access or remote operations without sufficient need or user intent. In a skill that can reach production infrastructure, overbroad triggering expands the attack surface and raises the risk of unnecessary privileged actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill includes operational commands that can stop or restart services, which may disrupt availability if copied blindly, yet the nearby guidance does not clearly warn about service impact or require confirmation. In remote server administration context, such commands are expected, but presenting them without strong guardrails makes accidental disruption more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
systemctl status nginx

# Start service
sudo systemctl start nginx

# Stop service
sudo systemctl stop nginx

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
systemctl status nginx

# Start service
sudo systemctl start nginx

# Stop service
sudo systemctl stop nginx

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
systemctl status nginx

# Start service
sudo systemctl start nginx

# Stop service
sudo systemctl stop nginx

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
systemctl status nginx

# Start service
sudo systemctl start nginx

# Stop service
sudo systemctl stop nginx

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The security notes state 'Never send passwords directly in chat' and 'Passwords are encrypted and stored locally,' implying the skill avoids password handling beyond secure local storage. Later documentation instructs users to use ssh_config.py add and enter a password that is then stored in servers.json as password_encrypted, so the skill does in fact handle and persist passwords as part of its workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The document is primarily in English but includes Chinese text in the dependency path description (Win10/11自带) without any user opt-in or stated locale requirement. This can conflict with language consistency policies when the skill does not explicitly offer or justify mixed-language output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is written only in Chinese, which can impose a language choice on users without indicating any opt-in or alternative locale support. This matches the policy category for language or locale constraints expressed in natural-language metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.