The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The gpu-server.py script implements an unauthenticated HTTP API that listens on 0.0.0.0:8420 by default. The /submit endpoint accepts arbitrary shell commands in a JSON payload and executes them immediately on the host machine using asyncio.create_subprocess_shell.
[COMMAND_EXECUTION]: The client-side gpu-remote.sh and gpu-server.py are designed specifically to execute arbitrary shell commands on a remote host. While this is the intended functionality, the lack of authentication or transport security in the API mode presents a significant risk.
[DATA_EXFILTRATION]: The server component provides file download capabilities via the /jobs/{id}/files/{filename} endpoint. Combined with the unauthenticated command execution, this can be used to read and exfiltrate sensitive files from the server.
[EXTERNAL_DOWNLOADS]: The setup-nuc.sh script fetches and executes setup scripts from Astral's UV repository, the official Rust toolchain installer, and NodeSource. These are well-known technology services used for environment bootstrapping.
[COMMAND_EXECUTION]: The setup-nuc.sh script performs high-privilege operations including modifying /etc/systemd/system/ to create a persistence service and using sudo apt-get for package installation.

remote-gpu