The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's ssh_config.py script reads and outputs the entire content of the ~/.ssh/config file. This file is highly sensitive as it reveals server hostnames, usernames, network topology, and paths to private identity files (IdentityFile).
[PRIVILEGE_ESCALATION]: The 'add' command in scripts/ssh_config.py does not validate or sanitize input arguments such as --host or --user. This vulnerability allows for the injection of malicious SSH directives (e.g., ProxyCommand, PermitLocalCommand, or LocalForward) via newline characters. An injected ProxyCommand would result in arbitrary code execution on the local machine the next time the specific SSH alias is used.
[COMMAND_EXECUTION]: The skill provides functional wrappers for ssh, scp, and ssh tunneling. While these are the intended features, they provide a broad surface for executing arbitrary commands on remote systems, which can be abused if the agent is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill parses and utilizes comments from the SSH configuration as metadata (description, tags, location). If a user's configuration is modified by an external process or malicious actor, this metadata could be used to inject instructions that influence the agent's behavior when managing servers.
[CREDENTIALS_UNSAFE]: By exposing the paths to private SSH keys and identity files through its configuration listing commands, the skill facilitates the discovery of sensitive authentication credentials stored on the local filesystem.

ssh