SAPCONET SSH Bridge

Standard SAPCONET SSH command templates for bird reads, Puppeteer runs, and inbox messaging workflows.

This skill is basically two SSH wrapper scripts and is coherent with its stated purpose, but before installing or running it you should: 1) manually inspect both scripts (they contain placeholders that become remote commands); 2) replace the default SAPCONET_TARGET ([email protected]) with a host you control/trust; 3) ensure your SSH keys/agent are configured rather than entering credentials inline; 4) avoid allowing the agent to autonomously execute these scripts against external hosts unless you explicitly trust the target; and 5) ask the publisher for provenance (source/homepage) if you need accountability — the registry metadata lists no homepage and an unknown owner.

Type: OpenClaw Skill Name: sapconet-ssh-bridge Version: 0.1.0 The skill is classified as suspicious due to a remote shell injection vulnerability found in `scripts/msg-sapconet.sh`. The script directly interpolates the `$MESSAGE` argument into the remote SSH command string without proper sanitization, allowing an attacker to execute arbitrary commands on the `SAPCONET_TARGET` host if they can control the `MESSAGE` input. While the script is presented as a template with 'TODO' placeholders, this lack of input sanitization constitutes a significant security flaw, even without clear evidence of intentional malice.