Claude Code Remote Executor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

This skill is a real remote Claude Code dispatcher, but it deploys unauthenticated remote execution paths with permission checks disabled.

Review before installing. Only use this on trusted private networks and trusted hosts after adding authentication for FastAPI and Redis, removing Claude permission bypass, disabling shell-based prompt execution, restoring SSH host-key verification, and defining stop/uninstall procedures for the background services.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/deploy_m1.py:64

Finding

Unauthenticated Network Endpoint Executes Claude with Permission Checks Disabled

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/exec.py:109

Finding

Unauthenticated and Unencrypted Redis Queue Allows Task Injection and Result Tampering

Content

View full analysis

bool: try: return self.r.ping() except Exception: return False def submit(self, task_id: str, prompt: str) -> bool: try: task = { "task_id": task_id, "prompt": prompt, "exec_mode": "claude" } self.r.lpush(QUEUE, json.dumps(task)) return True except Exception: return False ``` The generated worker similarly connects without credentials: ```python r = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True) r.ping() ``` ### Technical Analysis Redis connections are established without a username, password, TLS configuration, client certificate, or message-level authentication. The queue itself is an execution boundary because the worker treats messages in `claude_tasks` as trusted prompts. Any party that can reach this Redis instance can potentially push forged tasks directly, bypassing the FastAPI channel entirely. Such a party may also read or overwrite status and result keys, interfere with queued tasks, or exhaust queue and storage resources. The danger is amplified because the consumer executes Claude with permission checks disabled. ### Attack Path 1. An attacker gains network connectivity to the configured Redis host and port. 2. The attacker connects without credentials. 3. The attacker submits a crafted JSON message using `LPUSH claude_tasks`. 4. The worker accepts the message without verifying its origin or integrity. 5. The worker passes the attacker-controlled prompt to permission-bypassed Claude. 6. The attacker reads `claude_result:` or manipulates result and status keys. 7 ...[truncated 539 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/exec.py:158

Finding

Shell Injection in the SSH Screen Fallback

Content

View full analysis

bool: try: escaped_prompt = prompt.replace('\\', '\\\\').replace('"', '\\"').replace('$', '\\$').replace('`', '\\`') screen_name = f"cc_{task_id[:8]}" ssh_cmd = ( f"ssh -o ServerAliveInterval=30 -o StrictHostKeyChecking=no {SSH_HOST} " f"'screen -dmS {screen_name} /bin/zsh -c \"{escaped_prompt}\"'" ) r = subprocess.run(ssh_cmd, shell=True, capture_output=True, timeout=15) return r.returncode == 0 except Exception: return False ``` ### Technical Analysis Both `prompt` and `task_id` affect a command string passed to `subprocess.run(..., shell=True)`. The custom escaping covers only backslashes, double quotes, dollar signs, and backticks. It does not safely account for all parsing performed by the local shell, SSH, and the remote `zsh` process. In particular, single quotes, line breaks, and shell control syntax can disrupt the intended quoting structure. The optional task ID is also inserted into `screen_name` without validation. An attacker can provide it through `--task-id`. The implementation additionally contradicts the declared fallback behavior. Instead of sending a natural-language prompt to `CLAUDE_BIN`, it executes the prompt directly as `/bin/zsh -c` input. A prompt expected to be interpreted by Claude may therefore be interpreted as a shell program. ### Attack Path 1. An attacker or untrusted caller supplies a crafted prompt or `--task-id`. 2. The value is interpolated into `ssh_cmd`. 3. `shell=True` causes the local shell to parse the constructed command. 4. Crafted quoting or shell syntax escapes the intended command context. 5. Commands may execute locally or be delivered as attacker-selected remote shell commands. ...[truncated 455 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/exec.py:148

Finding

SSH Host-Key Verification Is Disabled

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/deploy_m1.py:46

Finding

Unpinned Packages Are Installed into the Remote Python Environment

Content

View full analysis

&1") if code != 0 or "OK" not in out: print(" Installing redis, uvicorn, fastapi...") ssh("pip3 install redis uvicorn fastapi --quiet 2>&1 | tail -2") print(" Dependencies installed") ``` The documentation also instructs: ```bash pip3 install redis uvicorn fastapi ``` ### Technical Analysis The deployment installs packages without fixed versions, hashes, a lock file, an isolated virtual environment, or an explicitly trusted package index. The packages resolved at deployment time may differ from those considered during review. Using the default `pip3` environment may also alter a shared user or system Python installation, producing dependency conflicts or exposing other applications to unexpected package versions. No evidence of typosquatting or an intentionally malicious package was found; the risk arises from unsafe dependency management and mutable supply-chain inputs. ### Attack Path 1. A user runs the deployment script. 2. One or more imports are unavailable, causing the installation branch to run. 3. `pip3` resolves the latest available versions from its configured index. 4. A compromised package release, index, mirror, or transitive dependency is selected. 5. Package installation or later imports execute affected code on the remote machine. ### Impact Assessment A compromised dependency can run with the privileges of the remote deployment account. Even without malicious compromise, incompatible upgrades may break the API or worker and modify a shared Python environment. ]]>

Remediation

View remediation

T06 · System Persistence

Warning

• Location: scripts/deploy_m1.py:185

Finding

Deployment Leaves Background Execution Services Active and Modifies the Remote Shell Profile

Content

View full analysis

/dev/null; sleep 1; nohup python3 /Users/m1-meng/workspace/cc_worker.py > /tmp/cc_worker.log 2>&1 & echo Worker PID: $!") print(" Worker restarted") print("\n5. Restarting API...") ssh("pkill -f cc_api 2>/dev/null; sleep 1; nohup python3 /Users/m1-meng/workspace/cc_api.py > /tmp/cc_api.log 2>&1 & echo API PID: $!") ``` The SSH deployment script also makes a lasting shell-profile change: ```bash if ! grep -q "alias m1=" ~/.zshrc 2>/dev/null; then echo 'alias m1="ssh m1"' >> ~/.zshrc echo "alias m1 added" fi ``` ### Technical Analysis The deployment starts the worker and API with `nohup`, allowing them to remain active after the initiating SSH session ends. This is consistent with the declared requirement for background components, but it creates a lasting attack surface and requires explicit lifecycle controls because the service is unauthenticated and permission-bypassed. The SSH deployment also modifies `.zshrc`, affecting future interactive shell sessions. This alias is not inherently malicious, but it is a persistent environment modification and is not essential to the core remote-execution functionality. The flagged cron-related line does not install a scheduled task; it only prints advice about adding one later. Likewise, `ControlPersist 600` creates a temporary reusable SSH connection rather than persistence across reboot. The `nohup` processes are not configured to restart after reboot. ### Attack Path 1. A user runs the deployment script once. 2. The API and worker continue running after the deployment SSH session exits. 3. The API remains reachable on all interfaces until terminated or the host restarts. 4. A later attacker reaches the unauthe ...[truncated 528 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A second description-behavior mismatch indicates the skill may edit SSH configuration, set up connection pooling, alter shell initialization files, and perform direct SSH-based host configuration despite being presented as a three-channel task dispatcher. Hidden host reconfiguration and shell-init changes materially increase persistence and control on remote machines beyond what a user would expect from the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second description-behavior mismatch indicates the skill may edit SSH configuration, set up connection pooling, alter shell initialization files, and perform direct SSH-based host configuration despite being presented as a three-channel task dispatcher. Hidden host reconfiguration and shell-init changes materially increase persistence and control on remote machines beyond what a user would expect from the description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The deployed worker invokes Claude with --permission-mode bypassPermissions, explicitly disabling normal safeguards for a remote task executor. Combined with Redis-delivered prompts, this gives anyone who can enqueue tasks a powerful remote code execution pathway on the target machine with reduced guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Beyond being a risky configuration choice, enabling bypassed permissions in a generated worker without strong warning or safety gates makes dangerous execution easy to deploy accidentally. Because this skill is expressly for dispatching commands to a remote Claude instance, suppressed safeguards materially increase the chance of misuse and system compromise.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 27)May include surrounding context.

python

Host m1
    HostName 你的远程机器IP
    User m1-meng
    IdentityFile ~/.ssh/id_rsa
    
    # 保活：每10秒发送心跳，断3次则断开
    ServerAliveInterval 10

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/exec.py (reported line 40)May include surrounding context.

python

Host m1
    HostName 你的远程机器IP
    User m1-meng
    IdentityFile ~/.ssh/id_rsa
    
    # 保活：每10秒发送心跳，断3次则断开
    ServerAliveInterval 10

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The ProxyJump configuration routes through root@... while also assuming a reusable private key, which materially increases credential and trust exposure compared with a non-root bastion account. Even without key exfiltration, normalizing root as the transit user expands blast radius if that hop is compromised or misused.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 59)May include surrounding context.

python

HostName 你的远程机器IP
    User m1-meng
    ProxyJump root@你的中转机器IP
    IdentityFile ~/.ssh/id_rsa
    ServerAliveInterval 10
    ServerAliveCountMax 3
    ControlMaster auto

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Allowing arbitrary string commands to flow into subprocess.run with shell=True is a classic command-injection sink. Within an agent skill intended to dispatch remote actions, this pattern is especially sensitive because upstream prompts, tool outputs, or config values may eventually influence the executed string.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 72)May include surrounding context.

python

print(f"  {msg}", flush=True)

def run(cmd, capture=True):
    r = subprocess.run(cmd, shell=True, capture_output=capture, text=True, timeout=30)
    return r.returncode, r.stdout, r.stderr

def ssh_cmd(host, cmd, timeout=30):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The function combines unvalidated host and command text into a shell-invoked SSH command, enabling parameter abuse through shell metacharacters or crafted SSH arguments. This can result in execution of unintended local commands, malicious remote payloads, or option injection that changes trust behavior such as proxying or key usage.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 77)May include surrounding context.

python

def ssh_cmd(host, cmd, timeout=30):
    full_cmd = f'ssh -o "ServerAliveInterval=10" -o "ServerAliveCountMax=3" -o "ConnectTimeout=10" {host} "source ~/.zshrc && {cmd}"'
    r = subprocess.run(full_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def main():

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The same payload also appends raw SSH configuration text into a remote config file, so any future introduction of dynamic values into SSH_CONFIG, SSH_DIR, or CONFIG_FILE would become a direct remote command/config injection vector. In a skill already centered on remote execution, hidden configuration-writing sinks materially raise risk.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 95)May include surrounding context.

python

# 写入新配置
    code, out, err = ssh_cmd(HOST, f'''
mkdir -p {SSH_DIR}
chmod 700 {SSH_DIR}
cat > {CONFIG_FILE}.new << 'SSHEOF'
{SSH_CONFIG}
SSHEOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The same payload also appends raw SSH configuration text into a remote config file, so any future introduction of dynamic values into SSH_CONFIG, SSH_DIR, or CONFIG_FILE would become a direct remote command/config injection vector. In a skill already centered on remote execution, hidden configuration-writing sinks materially raise risk.

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 95)May include surrounding context.

python

# 写入新配置
    code, out, err = ssh_cmd(HOST, f'''
mkdir -p {SSH_DIR}
chmod 700 {SSH_DIR}
cat > {CONFIG_FILE}.new << 'SSHEOF'
{SSH_CONFIG}
SSHEOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/deploy_ssh.py (reported line 174)May include surrounding context.

python

print()
    print("手动清理连接池:")
    print("  ssh -O exit m1      # 关闭控制连接")
    print("  rm /tmp/ssh_mux_*   # 清除残留 socket")

if __name__ == "__main__":
    main()

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code claims to be a Claude Code remote executor, but one branch executes the prompt as a raw shell command. This violates least surprise and materially increases risk because callers expecting prompt dispatch may unknowingly trigger arbitrary command execution on a remote machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The screen fallback does not dispatch instructions to Claude Code; it directly runs the provided prompt as a shell command on the remote host. In the context of a skill advertised as remote Claude Code execution, this semantic mismatch is especially dangerous because users may supply natural-language instructions that are unexpectedly treated as executable shell input.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This path executes user-provided prompt text directly on a remote shell with no confirmation, guardrails, or safety warning. Given the skill context, that means a normal-language instruction can become arbitrary code execution on another machine, which is a severe integrity and availability risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Using subprocess.run(..., shell=True) with a command string that incorporates user-controlled prompt data is a classic tool-parameter abuse pattern. In this skill's context, it enables arbitrary remote shell execution and undermines the claimed purpose of merely forwarding instructions to Claude Code.

Content

Scanner excerpt · scripts/exec.py (reported line 177)May include surrounding context.

python

f"ssh -o ServerAliveInterval=30 -o StrictHostKeyChecking=no {SSH_HOST} "
                f"'screen -dmS {screen_name} /bin/zsh -c \"{escaped_prompt}\"'"
            )
            r = subprocess.run(ssh_cmd, shell=True, capture_output=True, timeout=15)
            return r.returncode == 0
        except Exception:
            return False

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes capabilities for network, shell, environment access, and file writes, yet declares no explicit tool scope or permission boundaries. For a skill centered on remote command dispatch, this omission is dangerous because it leaves a high-risk execution surface unconstrained and makes accidental or unauthorized remote actions more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on generic requests like asking to 'dispatch to Claude Code' or 'remote execute,' which increases the chance of unintended invocation. In a skill that can reach remote machines and issue commands, overbroad activation materially raises the risk of accidental high-impact actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation normalizes multiple remote execution paths, deployment steps, and process management operations without clear safety constraints, approval requirements, or warnings about trust boundaries. In context, this makes the skill more dangerous because it encourages direct remote code execution workflows without emphasizing authentication, authorization, command validation, or blast-radius control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The documented use of nohup to start a long-running worker in the background establishes persistent execution on the remote machine. While this may be operationally intended, persistence is security-relevant because it creates unattended code execution that can continue processing tasks after the initiating session ends.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

pip3 install redis uvicorn fastapi

# 启动 Worker（后台常驻）
nohup python3 cc_worker.py > worker.log 2>&1 &

# 启动 API
nohup python3 cc_api.py > api.log 2>&1 &

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The API is also launched via nohup as a detached background process, creating a persistent remote service that may remain exposed on the network. Without clear access control and lifecycle management, this increases the risk of unauthorized use, forgotten exposure, and harder-to-audit execution paths.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

nohup python3 cc_worker.py > worker.log 2>&1 &

启动 API

nohup python3 cc_api.py > api.log 2>&1 &

text

## 三通道（按优先级）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The restart command kills and relaunches the worker remotely in the background, reinforcing persistence and allowing remote process lifecycle control over command-executing components. In this skill's context, the ability to re-establish a task-processing daemon remotely increases operational control and potential abuse if the skill is misused or triggered unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

ssh 远程机器 "ps aux | grep cc_"

# 重启 Worker
ssh 远程机器 "pkill -f cc_worker; nohup python3 ~/cc_worker.py > ~/worker.log 2>&1 &"

# 重启 API
ssh 远程机器 "pkill -f cc_api; nohup python3 ~/cc_api.py > ~/api.log 2>&1 &"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The remote API restart command similarly re-establishes a persistent network-facing service, which can restore remote execution capability after interruption. In a remote-dispatch skill, this materially increases the ability to maintain continued access and service availability without strong governance.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

ssh 远程机器 "pkill -f cc_worker; nohup python3 ~/cc_worker.py > ~/worker.log 2>&1 &"

重启 API

ssh 远程机器 "pkill -f cc_api; nohup python3 ~/cc_api.py > ~/api.log 2>&1 &"

text

## 故障排查

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The ssh helper interpolates an arbitrary command string into a remote shell invocation (source ~/.zshrc && {cmd}), which creates a command-injection sink if any caller ever passes untrusted input. In this script the current call sites are mostly hardcoded, but the helper is generic and the skill’s purpose is remote execution, which makes this pattern especially dangerous in context.

Content

Scanner excerpt · scripts/deploy_m1.py (reported line 27)May include surrounding context.

python

HOST = SSH_HOST

def ssh(cmd, timeout=30):
    r = subprocess.run(
        ["ssh", "-o", "ServerAliveInterval=10", HOST, f"source ~/.zshrc && {cmd}"],
        capture_output=True, text=True, timeout=timeout
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/deploy_m1.py (reported line 34)May include surrounding context.

python

return r.returncode, r.stdout, r.stderr

def scp(local, remote):
    r = subprocess.run(["scp", "-o", "ServerAliveInterval=10", local, f"{HOST}:{remote}"],
                       capture_output=True, timeout=30)
    return r.returncode

Static analysis

No suspicious patterns detected.