Description
I'm an amateur, so please feel free to correct me if I'm wrong below.
The commandline parameter in the upload POST is very bad security practice. On no account should arbitrary strings from an external source be executed directly in the shell.
You'd argue that the command is signed with public-key cryptography, and is (mostly) unbreakable, and that's correct. However, it's only secure if your private key is not compromised. You'd then argue that if the private key is compromised it's all over anyway, and you'd be right again. But it's not just your machines that would be vulnerable when the key is compromised, but the attacker will also be able to execute commands on all of your users' computers as well, since arduino-create-agent will trust all such commands.
Instead I'd suggest that you build the command at the place where you'll be executing it (in arduino-create-agent when uploading over serial, and on your server when using network uploads). When building the command, avoid using user input directly in the command, and use them only as flags that enable/disable parts of the command. If you can't avoid interpolating user input, consider that a security vulnerability, and proceed with extreme caution to sanitise the input, and never trust that your sanitisation code works perfectly. If this is done right, you won't need signatures for the command anymore, and will have simplified the whole setup.
Also, I'm not sure why the upload via the network is done over ssh/scp. It unnecessarily introduces more attack surfaces that you need to safeguard. Use plain HTTP requests instead - it's well understood, has lots of tooling around it, scaling it is well understood, and most importantly doesn't give execute permissions on the shell. You already use HTTP as a fallback from my understanding.