中文 EN

Scan Report

Scan New Files

✓ Low Risk — Risk Score 10/100
Last scan:2 days ago Rescan
10 /100
ssh-handoff
Create and reuse a secure shared terminal handoff when a human must authenticate first and the agent must resume work in the same shell session afterward. Use for SSH handoff, sudo handoff, browser-opened temporary terminal access, or LAN-restricted terminal sharing backed by tmux.
A legitimate terminal handoff skill using tmux + ttyd for human/agent shared sessions. All shell execution, process management, and network features are fully declared and directly serve the stated purpose. The hardcoded TEST-NET IPs (192.0.2.x) are documented-only placeholders. No credential harvesting, exfiltration, or obfuscation found.
Skill Namessh-handoff
Duration54.8s
Enginepi
✓
Safe to install
Skill is safe to use. The only actionable improvement is to clarify that the hardcoded 192.0.2.x addresses in SKILL.md are documentation-only TEST-NET placeholders (already evident from context, but explicit labeling would eliminate ambiguity).

Findings 2 items

Severity Finding Location
Low
Hardcoded RFC 5737 TEST-NET IP addresses in SKILL.md
SKILL.md:122 references 192.0.2.10 and 192.0.2.20 as server and client IPs. These are RFC 5737 TEST-NET-1 documentation-only addresses with no routability on the public internet. They are explicitly labeled as placeholders in context, but explicit 'documentation-only' or 'TEST-NET' labels in the text would eliminate any ambiguity.
HOST=192.0.2.10 CLIENT_IP=192.0.2.20 PORT=48080 ...
→ Add a comment noting these are TEST-NET placeholders, e.g., '# Documentation-only RFC 5737 TEST-NET-1 addresses — replace with real IPs'
 SKILL.md:122
Low
Node.js runs with full environment variables
The Node.js proxy is launched with `env` passing ACCESS_TOKEN, SESSION_SECRET, TTL_MS, and other variables. The full process environment is inherited. While no secrets are exfiltrated and the environment is only used for legitimate configuration, a cleaner approach would explicitly pass only the needed variables.
nohup env LISTEN_HOST=... node ...
→ Consider passing only the necessary env vars explicitly to reduce the attack surface exposed to the proxy process
 scripts/start-url-token-web-terminal.sh:266
ResourceDeclaredInferredStatusEvidence
Shell WRITE WRITE ✓ Aligned SKILL.md declares tmux/ttyd/node/bash usage; all shell invocations in scripts ar…
Filesystem READ WRITE ✓ Aligned mktemp, state files, metadata files, cleanup scripts — all scoped to /tmp/ssh-ha…
Network READ WRITE ✓ Aligned SKILL.md guardrails document LAN browser-terminal modes; all network use is for …
Environment NONE READ ✓ Aligned Reads HOST, PORT, CLIENT_IP, TTL_MINUTES, etc. from environment — only for confi…
Skill Invoke NONE NONE — No cross-skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No direct browser automation; ttyd serves a web terminal but is a declared confi…
Database NONE NONE — No database access
2 High 4 findings
📡
High IP Address 硬编码 IP 地址
192.0.2.10
SKILL.md:122
📡
High IP Address 硬编码 IP 地址
192.0.2.20
SKILL.md:122
🔗
Medium External URL 外部 URL
https://$EXPECTED_HOST
scripts/start-url-token-web-terminal.sh:229
🔗
Medium External URL 外部 URL
http://$EXPECTED_HOST
scripts/start-url-token-web-terminal.sh:231

File Tree

9 files · 41.5 KB · 1376 lines
Markdown 5f · 555L Shell 3f · 484L JavaScript 1f · 337L
├─ ▾ 📁 references
│ ├─ 📝 design-notes.md Markdown 122L · 3.2 KB
│ ├─ 📝 examples.md Markdown 48L · 1.6 KB
│ └─ 📝 lan-restricted.md Markdown 37L · 1.3 KB
├─ ▾ 📁 scripts
│ ├─ 🔧 start-local-web-terminal.sh Shell 88L · 2.0 KB
│ ├─ 🔑 start-url-token-web-terminal.sh ⚠ Shell 376L · 11.2 KB
│ ├─ 🔧 stop-local-web-terminal.sh Shell 20L · 335 B
│ └─ 🔑 url-token-proxy.js ⚠ JavaScript 337L · 9.3 KB
├─ 📝 README.md Markdown 112L · 3.9 KB
└─ 📝 SKILL.md Markdown 236L · 8.6 KB

Security Positives

✓ Comprehensive guardrails documented in SKILL.md: no public tunnels, no external channels, no credential pasting in chat
✓ TTL-based automatic cleanup of all temporary processes and files
✓ One-shot token pattern prevents URL replay attacks
✓ Strict Host header and Origin checks in the proxy prevent request smuggling
✓ IP allowlisting for LAN mode restricts access to a single trusted client IP
✓ FORBID_REUSE_IF_AUTHENTICATED prevents accidental re-exposure of already-authenticated sessions
✓ Port conflict detection prevents the launcher from killing existing processes silently
✓ No credential harvesting: secrets.token_urlsafe() generates only ephemeral one-shot tokens
✓ No external network connections: ttyd backend binds to localhost, proxy binds to configured HOST
✓ No obfuscation techniques (base64, eval, atob) anywhere in the codebase
✓ Source is readable and auditable; no minified or obfuscated code
✓ Well-structured references (design-notes.md, examples.md, lan-restricted.md) clarify security rationale