ssh-doctor

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt includes an out-of-scope instruction to retrieve and copy a Codex-managed OP_SERVICE_ACCOUNT_TOKEN from a remote host into ~/.profile (effectively exfiltrating/persisting a secret), which is unrelated to the stated SSH-diagnostics purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow includes fetching and ingesting remote user-authored free text via ssh ... HOST 'awk ... ~/.profile' (outsider source: remote host’s ~/.profile content), which is then parsed/inserted into the agent context/output.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly runs many sudo commands that change system state (enable Remote Login, restart/modify sshd via launchctl, inspect/change /etc/ssh/sshd_config, kill sshd-session processes, modify firewall settings and user profiles), which requires elevated privileges and can alter the machine's configuration.