colab-remote

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to insert user-provided secrets verbatim (e.g., launch_ssh("YOUR_NGROK_TOKEN") and launch_ssh_cloudflared(password="your-password-here")) and to write connection details into files, which requires the LLM to handle and output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content explicitly instructs how to install a reverse SSH tunnel (colab-ssh via ngrok/cloudflared), create publicly routable root SSH access to ephemeral Colab runtimes, automate injection of that setup via a browser agent, keep the session alive, and transfer files (scp / Drive mount) — together these are dual-use but constitute clear remote-code-execution/backdoor capability and enable straightforward data exfiltration if abused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs a Colab cell that executes "!pip install colab-ssh" and then calls colab_ssh.launch_ssh (which fetches and runs remote package code from PyPI (e.g. https://pypi.org/project/colab-ssh/) and uses the ngrok service (https://ngrok.com) at runtime to establish tunnels), so remote code is fetched and executed during skill runtime and is required for the skill to work.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt instructs automated SSH access as root (storing credentials locally), disables SSH host-key checking (security bypass), and runs privileged commands on the remote runtime—effectively enabling privileged remote state changes and potential compromise.