virtual-remote-desktop

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:53 PM UTC
• Version: 1.0.3

Overview

The skill matches its remote-desktop purpose, but it needs review because it combines powerful desktop access with unsafe install, state-loading, and public-exposure choices.

Install only if you are comfortable reviewing and operating a network-accessible remote desktop tool. Prefer local 127.0.0.1 plus SSH tunnel, avoid public 0.0.0.0 mode unless separately protected by firewall/VPN/trusted TLS, do not run it around sensitive screens unless screenshot logging is acceptable, and review or pin the KasmVNC package before allowing sudo installation. Treat the current version as needing maintainer fixes for shell-safe state storage and safer privilege handling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/start_vrd.sh:355

Finding

Arbitrary Shell Command Injection Through Sourced Runtime State File

Content

View full analysis

"${PIDFILE}" </dev/null || true ``` The resulting file is then interpreted as executable shell syntax. For example, `scripts/watch_vrd_idle.sh:20-31` contains: ```bash # shellcheck disable=SC1090 source "${PIDFILE}" SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)" STOP_SCRIPT="${SCRIPT_DIR}/stop_vrd.sh" idle_for=0 while true; do if [[ ! -f "${PIDFILE}" ]]; then exit 0 fi # shellcheck disable=SC1090 source "${PIDFILE}" ``` ### Technical Analysis Values such as `AUTO_ ...[truncated 1798 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install_kasmvnc.sh:28

Finding

Mutable Unverified Package Is Downloaded and Installed With Root Privileges

Content

View full analysis

&2 exit 1 fi TMP_DEB="/tmp/$(basename "${ASSET_URL}")" echo "[INFO] downloading ${ASSET_URL}" wget -qO "${TMP_DEB}" "${ASSET_URL}" echo "[INFO] installing ${TMP_DEB}" sudo apt-get update -qq # core runtime deps for AI action scripts + lightweight desktop sudo apt-get install -y "${TMP_DEB}" fluxbox xdotool scrot xauth ``` ### Technical Analysis The installer queries the mutable GitHub `releases/latest` endpoint, obtains a package URL, downloads the package, and passes it to `sudo apt-get install`. No reviewed version, cryptographic checksum, or trusted package signature is pinned and verified by the script. Consequently, the effective code installed by the Skill can change after the Skill itself has been audited. A compromised upstream release or account could cause a malicious Debian package to be installed. Debian package maintainer scripts execute under root during installation. The package is also downloaded to a predictable path in the shared `/tmp` directory. The script does not use a private temporar ...[truncated 1683 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/start_vrd.sh:236

Finding

Public Remote Desktop Mode Relies on a Generic Self-Signed TLS Certificate

Content

View full analysis

"${KASM_CFG}" <"${LOGDIR}/kasmvnc-start.log" 2>&1 ``` Public mode then advertises the exposed endpoint and prints its credentials: ```bash if [[ "${KASM_BIND}" == "0.0.0.0" ]]; then URL_HOST="${PUBLIC_HOST:-${PUBLIC_IP:-0.0.0.0}}" echo "KasmVNC is up (public bind)." echo "URL: https://${URL_HOST}:${KASM_PORT}/" else echo "KasmVNC is up (local bind)." echo "URL: https://127.0.0.1:${KASM_PORT}/" echo "SSH tunnel: ssh -L ${KASM_PORT}:127.0.0.1:${KASM_PORT} @" fi echo "Username: ${KASM_USER}" e ...[truncated 2172 chars]

Remediation

View remediation

other

Note

• Location: scripts/start_vrd.sh:393

Finding

Public Mode Discloses Host Network Metadata to Undocumented Third-Party Services

Content

View full analysis

/dev/null || true import urllib.request for u in ("https://api.ipify.org", "https://ifconfig.me/ip", "https://checkip.amazonaws.com"): try: print(urllib.request.urlopen(u, timeout=2).read().decode().strip()) break except Exception: pass PY )" fi ``` ### Technical Analysis When public mode is selected, the script automatically contacts up to three external public-IP discovery services. Each contacted provider receives the host's source IP address, request timing, and ordinary TLS/HTTP connection metadata. The static pre-scan warning about sending sensitive information over the network corresponds to these requests. The script does not transmit the generated KasmVNC password, browser cookies, or other local secrets to these services. Nevertheless, the requests disclose infrastructure metadata and are not described in the Skill documentation. The fallback loop can disclose the metadata to multiple providers if earlier requests fail. Public-IP discovery is convenient for displaying a URL, but it is not required to start KasmVNC and therefore is not the minimum network access necessary for the core functionality. ### Attack Path 1. The operator selects public mode by setting `KASM_BIND=0.0.0.0`. 2. The startup script automatically requests `https://api.ipify.org`. 3. If that request fails, it requests `https://ifconfig.me/ip`, followed by `https://checkip.amazonaws.com` if necessary. 4. Each reached service observes the host's public source IP and the time the virtual desktop public mode was started. 5. The returned address is used to construct the displayed KasmVNC URL. ### Impact Assessment The exposed inf ...[truncated 300 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full virtual desktop environment for assisted automation and human intervention. The provided code chunk does not implement or expose any of those core capabilities. Instead, it only waits a specified number of seconds and then invokes another screenshot script. While taking screenshots could be a supporting detail inside a larger desktop automation system, this code chunk by itself is materially narrower and its observable behavior is not accurately represented by the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script base64-encodes the captured screenshot and emits the entire image to stdout, making sensitive desktop contents available to any caller, wrapper, log collector, orchestration layer, or downstream agent consuming command output. Given this skill is designed for remote desktop automation with human takeover during risky authentication flows, stdout exposure can leak highly sensitive visual data far beyond the intended interactive user.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/health_vrd.sh (reported line 30)May include surrounding context.

sh

check_pid "kasmvnc" "${KASM_PID:-}"

HTTP_CODE="$(curl -k -s -o /dev/null -w "%{http_code}" "https://127.0.0.1:${KASM_PORT}/" || true)"
if [[ "${HTTP_CODE}" == "200" || "${HTTP_CODE}" == "401" ]]; then
  ok "KasmVNC endpoint reachable (HTTP ${HTTP_CODE})"
else

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script unconditionally removes /tmp/.X${DISPLAY_NUM}-lock and /tmp/.X11-unix/X${DISPLAY_NUM} based on an environment-controlled display number. Although DISPLAY_NUM is constrained to digits, deleting X lock/socket files without verifying ownership or staleness can disrupt another active X/VNC session and creates a local denial-of-service risk in multi-user environments.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 270)May include surrounding context.

sh

ensure_ssl_group

# Ensure no stale display lock
rm -f "/tmp/.X${DISPLAY_NUM}-lock" "/tmp/.X11-unix/X${DISPLAY_NUM}" 2>/dev/null || true

# Configure non-interactive desktop selection for this HOME
HOME="${KASM_HOME}" /usr/lib/kasmvncserver/select-de.sh --select-de manual --assume-yes >/dev/null 2>&1 || true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/stop_vrd.sh (reported line 55)May include surrounding context.

sh

# Fallback cleanup for stale processes
pkill -f "Xvnc :${DISPLAY_NUM:-55}" 2>/dev/null || true
rm -f "/tmp/.X${DISPLAY_NUM:-55}-lock" "/tmp/.X11-unix/X${DISPLAY_NUM:-55}" 2>/dev/null || true

echo "Stopped virtual remote desktop stack."

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents shell commands, network-facing remote desktop setup, and browser automation, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and reviewability, because an agent may be permitted to use powerful shell and network capabilities without a clear contract limiting their intended use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly recommends a 'temporary public takeover' mode using KASM_BIND=0.0.0.0, which exposes the remote desktop on all network interfaces, but the warning is too weak and does not clearly communicate the exposure risk. In the context of a remote desktop that handles login, CAPTCHA, and MFA handoff, accidental public exposure could allow unauthorized access attempts, credential theft, or session hijacking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script captures a full desktop screenshot and persists it to disk in a predictable working directory with no access-control checks, minimization, retention policy, or user disclosure. In this skill's context, the desktop is explicitly used for login approvals, captchas, and other human-intervention steps, so screenshots may contain credentials, session tokens, personal data, or sensitive account state that can later be read by other local processes or exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code invokes another script named action_screenshot.sh, which strongly suggests capture of screen data, but this file provides no user-facing notice, confirmation, or explanatory comment before doing so. For code files, operations that may affect privacy or system data should include some visible disclosure unless clearly warned elsewhere.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_kasmvnc.sh (reported line 13)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_kasmvnc.sh (reported line 55)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_kasmvnc.sh (reported line 61)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 96)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 113)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 128)May include surrounding context.

sh

need_bin python3
need_bin wget
need_bin sudo

if command -v vncserver >/dev/null 2>&1 && vncserver -help 2>&1 | grep -qi kasmvnc; then
  echo "[OK] KasmVNC already installed"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install_kasmvnc.sh (reported line 32)May include surrounding context.

sh

import requests,sys
codename='${CODENAME}'
arch='${ARCH}'
release=requests.get('https://api.github.com/repos/kasmtech/KasmVNC/releases/latest',timeout=20).json()
assets=release.get('assets',[])
preferred=[f'kasmvncserver_{codename}_', 'kasmvncserver_noble_', 'kasmvncserver_jammy_', 'kasmvncserver_focal_', 'kasmvncserver_bookworm_']
for prefix in preferred:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script downloads a .deb chosen from live GitHub release metadata and installs it with sudo, giving the package full root-level install privileges. If the upstream release account, release metadata, transport path, or selected asset is compromised, this becomes a supply-chain execution path that can run arbitrary code as root on the host.

Content

Scanner excerpt · scripts/install_kasmvnc.sh (reported line 57)May include surrounding context.

sh

echo "[INFO] installing ${TMP_DEB}"
sudo apt-get update -qq
# core runtime deps for AI action scripts + lightweight desktop
sudo apt-get install -y "${TMP_DEB}" fluxbox xdotool scrot xauth

if ! id -nG "$USER" | tr ' ' '\n' | grep -qx 'ssl-cert'; then
  echo "[INFO] adding ${USER} to ssl-cert group"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically calls sudo usermod -a -G ssl-cert "$USER" if the current user lacks the ssl-cert group. Modifying system group membership is a privileged, persistent system change outside normal per-session virtual desktop setup, and it expands the user's ability to read private TLS key material associated with that group.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This line is part of logic that conditionally invokes sudo to alter the user's group membership. Triggering privilege escalation from a routine startup script is dangerous because it causes persistent host-level authorization changes beyond the scope of launching a remote desktop session.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 108)May include surrounding context.

sh

if id -nG "$USER" | tr ' ' '\n' | grep -qx 'ssl-cert'; then
    return 0
  fi
  if command -v sudo >/dev/null 2>&1; then
    echo "[INFO] adding user '${USER}' to ssl-cert group (required by KasmVNC TLS cert)"
    sudo usermod -a -G ssl-cert "$USER"
    return 0

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

sudo usermod -a -G ssl-cert "$USER" grants the user membership in a privileged group, changing future access rights on the host. This is a persistent privilege/authorization modification and exceeds the expected behavior of a session launcher.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 110)May include surrounding context.

sh

fi
  if command -v sudo >/dev/null 2>&1; then
    echo "[INFO] adding user '${USER}' to ssl-cert group (required by KasmVNC TLS cert)"
    sudo usermod -a -G ssl-cert "$USER"
    return 0
  fi
  echo "[ERR] user is not in ssl-cert and sudo is unavailable" >&2

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 221)May include surrounding context.

sh

printf '%s\n' "${KASM_USER}" > "${KASM_USER_FILE}"
printf '%s\n' "${KASM_PASS}" > "${KASM_SECRET_FILE}"
chmod 600 "${KASM_USER_FILE}" "${KASM_SECRET_FILE}" 2>/dev/null || true

cat > "${KASM_HOME}/.vnc/xstartup" <<'EOF'
#!/usr/bin/env bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 265)May include surrounding context.

sh

printf '%s\n' "${KASM_USER}" > "${KASM_USER_FILE}"
printf '%s\n' "${KASM_PASS}" > "${KASM_SECRET_FILE}"
chmod 600 "${KASM_USER_FILE}" "${KASM_SECRET_FILE}" 2>/dev/null || true

cat > "${KASM_HOME}/.vnc/xstartup" <<'EOF'
#!/usr/bin/env bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 277)May include surrounding context.

sh

printf '%s\n' "${KASM_USER}" > "${KASM_USER_FILE}"
printf '%s\n' "${KASM_PASS}" > "${KASM_SECRET_FILE}"
chmod 600 "${KASM_USER_FILE}" "${KASM_SECRET_FILE}" 2>/dev/null || true

cat > "${KASM_HOME}/.vnc/xstartup" <<'EOF'
#!/usr/bin/env bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 391)May include surrounding context.

sh

printf '%s\n' "${KASM_USER}" > "${KASM_USER_FILE}"
printf '%s\n' "${KASM_PASS}" > "${KASM_SECRET_FILE}"
chmod 600 "${KASM_USER_FILE}" "${KASM_SECRET_FILE}" 2>/dev/null || true

cat > "${KASM_HOME}/.vnc/xstartup" <<'EOF'
#!/usr/bin/env bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/start_vrd.sh (reported line 342)May include surrounding context.

sh

"${AUTO_LAUNCH_URL}"
  )

  nohup env DISPLAY=":${DISPLAY_NUM}" "${CHROME_BIN_ACTUAL}" \
    "${CHROME_ARGS[@]}" \
    >"${LOGDIR}/chrome.log" 2>&1 &
  CHROME_PID="$!"

Static analysis

No suspicious patterns detected.