ssh-ops
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill enables the execution of arbitrary shell commands on remote systems. While the instructions require pre-checks and manual approval for destructive operations, the tool grants significant control over remote environments.
- [INDIRECT_PROMPT_INJECTION]: The skill captures and interprets stdout and stderr from remote commands, which could be exploited by an attacker-controlled host to inject instructions into the agent's context.
- Ingestion points: The skill explicitly records 'full stdout/stderr and exit status for each command' as documented in SKILL.md.
- Boundary markers: The instructions do not define delimiters or specific markers to isolate untrusted remote output from the agent's reasoning space.
- Capability inventory: The skill possesses the capability to execute interactive shell commands and manage session states.
- Sanitization: There is no evidence of filtering, escaping, or validation being applied to the remote output before it is returned to the agent context.
- [METADATA_POISONING]: The SKILL.md file contains metadata attributing the skill to 'GhostWorks', which differs from the provided author attribution of 'specterops'.
Audit Metadata