Claude Code Remote Executor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This skill really is a remote Claude Code executor, but it exposes broad remote execution paths that need careful review before use.

Install only if you intentionally want to operate a remote code-execution control plane. Before use, add authentication and network restrictions for the API and Redis, remove bypassPermissions or require explicit approval, disable the screen shell fallback, use a dedicated low-privilege account and project directory, and document how to stop and remove the background services.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

HOST = SSH_HOST

def ssh(cmd, timeout=30):
    r = subprocess.run(
        ["ssh", "-o", "ServerAliveInterval=10", HOST, f"source ~/.zshrc && {cmd}"],
        capture_output=True, text=True, timeout=timeout
    )

• Confidence: 95% confidence
• Finding: The ssh helper concatenates an arbitrary command string into a remote shell invocation (`source ~/.zshrc && {cmd}`), so any untrusted or improperly constrained input passed to `ssh()` becomes remote shell execution. In this file the current call sites are hardcoded, but the primitive itself is dangerous in a remote-execution skill because it normalizes shell-string injection as the control path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  {msg}", flush=True)

def run(cmd, capture=True):
    r = subprocess.run(cmd, shell=True, capture_output=capture, text=True, timeout=30)
    return r.returncode, r.stdout, r.stderr

def ssh_cmd(host, cmd, timeout=30):

• Confidence: 96% confidence
• Finding: The helper executes arbitrary shell strings with shell=True, which makes any variable or future caller-controlled content subject to shell metacharacter injection. In this script it is used to launch SSH commands and can lead to unintended local command execution if command strings are modified or parameterized later.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def ssh_cmd(host, cmd, timeout=30):
    full_cmd = f'ssh -o "ServerAliveInterval=10" -o "ServerAliveCountMax=3" -o "ConnectTimeout=10" {host} "source ~/.zshrc && {cmd}"'
    r = subprocess.run(full_cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    return r.returncode, r.stdout, r.stderr

def main():

• Confidence: 99% confidence
• Finding: ssh_cmd constructs a shell command by interpolating both host and remote cmd into a single string and then executes it with shell=True. This creates both local shell-injection risk and remote command-injection risk if either value is ever influenced by external input, which is especially dangerous in a remote-execution skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f"ssh -o ServerAliveInterval=30 -o StrictHostKeyChecking=no {SSH_HOST} "
                f"'screen -dmS {screen_name} /bin/zsh -c \"{escaped_prompt}\"'"
            )
            r = subprocess.run(ssh_cmd, shell=True, capture_output=True, timeout=15)
            return r.returncode == 0
        except Exception:
            return False

• Confidence: 99% confidence
• Finding: This call executes a constructed SSH command with `shell=True`, and the command embeds user-controlled prompt content for remote `/bin/zsh -c` execution. The skill's stated purpose is dispatching work to remote Claude Code, but this path creates a general-purpose remote shell execution primitive, making arbitrary command execution possible on the remote host.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The generated worker runs Claude with `--permission-mode bypassPermissions`, explicitly disabling safety gates while consuming prompts from a Redis queue. In the context of a remote dispatch skill, this creates a highly dangerous unaudited remote agent that can perform destructive actions on the target machine based solely on queued prompt content.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script makes broad SSH and shell-environment changes on the target machine that exceed the stated purpose of dispatching Claude Code commands. This mismatch increases risk because users invoking a remote-dispatch skill may not expect persistent workstation reconfiguration and remote state changes.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements SSH hardening and environment setup rather than the manifest-described three-channel remote dispatch flow. Such capability drift is risky in agent skills because it hides additional power and persistence behind a different advertised purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The screen fallback runs the provided prompt directly inside a remote shell, which is much broader than submitting work to Claude Code. In this skill context, that mismatch is especially dangerous because users may believe they are invoking a bounded coding agent while actually granting arbitrary remote command execution.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code exposes a general-purpose remote shell capability via SSH screen that is not necessary for the stated feature of dispatching Claude Code tasks. The hidden expansion of scope from 'remote Claude tasking' to arbitrary shell execution materially increases the chance of destructive commands, persistence, data theft, or lateral movement on the remote machine.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad and loosely scoped, including generic ideas like 'remote execute' or 'send to Claude Code.' In a skill that performs remote command dispatch and system management, ambiguous triggering raises the chance of unintended invocation leading to accidental actions on remote hosts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown describes remote execution, queue submission, SSH process control, and deployment behavior without an explicit warning that these actions can alter remote systems and create persistent services. In this context, missing impact warnings materially increases risk because users may not appreciate that invocation can start daemons, install packages, and change operational state on another machine.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script silently deploys a worker that executes in elevated `bypassPermissions` mode without any user-facing consent, warning, or confirmation. This is dangerous because operators may believe they are deploying ordinary remote execution while actually creating an unrestricted agent channel with much higher blast radius.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script writes remote files and modifies SSH configuration without any interactive confirmation, dry-run mode, or explicit warning that persistent system state will change. In an agent context, silent remote mutation can surprise users and make accidental or unsafe deployment more likely.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The subprocess wrappers trigger remote shell execution and local shell parsing without surfacing clear safety messaging or operator acknowledgment. In a remote-execution skill, lack of warnings materially increases the chance of unintended state changes and unsafe command dispatch.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends user-provided prompt content into a remote shell without any explicit warning, confirmation, or separation between natural-language tasking and shell command execution. That creates a dangerous expectation gap and increases the likelihood of accidental misuse even if no attacker is present.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.