mac-mini-screen-sharing

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This code intentionally automates and persists credential-based remote Screen Sharing access: it stores the target account password in the local Keychain, remotely runs sudo via SSH to disable the Screen Sharing permission prompt (ScreenSharingReqPermEnabled = 0) and restarts the service, and automates signing-in — behavior that can be used as a backdoor to enable covert persistent remote control (no evidence of external data exfiltration or obfuscation in the provided files).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The setup script invokes SSH to the remote host (e.g., ssh iam@192.168.40.23 with a remote sudo command 'defaults write ... && launchctl kickstart ...'), which is used at runtime and executes commands on the remote Mac mini, so it is an external runtime dependency that executes remote code.