ssh-essentials

github.com/clawhub.ai/cpgeek-ssh-essentials
Verdict: Proceed with caution
0 critical23 high1 medium
C
SCORE 55 / 100
$skillox install ssh-essentialsSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 23 high-severity findings (3+ HIGHs → C).

0 CRIT23 HIGH1 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 21 of 23 HIGH (cap is 2).

  • A
    Reach Atarget score 95

    Resolve all 23 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-vncdrctgjovuk9kq16vol3aw · Thu, 28 May 2026 17:03:08 GMT · 4ms

high
Dangerous shell pattern: eval $()
The skill contains a shell command pattern (`eval $()`) commonly used in destructive or supply-chain attacks.
rule: dangerous-shellline: 96CWE-78
▾
94```bash
95# Start ssh-agent
96eval $(ssh-agent)← eval $() — common in destructive or supply-chain attacks
97
98# Add key to agent
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 26CWE-552
▾
24
25# Connect with specific key
26ssh -i ~/.ssh/id_rsa user@hostname← sensitive path — credential-exfiltration vector
27
28# Connect and run command
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 66CWE-552
▾
64
65# Generate with custom filename
66ssh-keygen -t ed25519 -f ~/.ssh/id_myserver← sensitive path — credential-exfiltration vector
67
68# Generate without passphrase (automation)
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 69CWE-552
▾
67
68# Generate without passphrase (automation)
69ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_deploy← sensitive path — credential-exfiltration vector
70# (⚠️ WARNING: Keys without passphrases are stored as plaintext on disk.
71# If the key file is stolen, anyone can use it. For automation, prefer ssh-agent
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 81CWE-552
▾
79
80# Copy specific key
81ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname← sensitive path — credential-exfiltration vector
82
83# Manual key copy
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 84CWE-552
▾
82
83# Manual key copy
84cat ~/.ssh/id_rsa.pub | ssh user@hostname 'cat >> ~/.ssh/authorized_keys'← sensitive path — credential-exfiltration vector
85
86# Check key fingerprint
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 87CWE-552
▾
85
86# Check key fingerprint
87ssh-keygen -lf ~/.ssh/id_rsa.pub← sensitive path — credential-exfiltration vector
88
89# Change key passphrase
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 90CWE-552
▾
88
89# Change key passphrase
90ssh-keygen -p -f ~/.ssh/id_rsa← sensitive path — credential-exfiltration vector
91```
92
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 99CWE-552
▾
97
98# Add key to agent
99ssh-add ~/.ssh/id_rsa← sensitive path — credential-exfiltration vector
100
101# List keys in agent
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 105CWE-552
▾
103
104# Remove key from agent
105ssh-add -d ~/.ssh/id_rsa← sensitive path — credential-exfiltration vector
106
107# Remove all keys
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 111CWE-552
▾
109
110# Set key lifetime (seconds)
111ssh-add -t 3600 ~/.ssh/id_rsa← sensitive path — credential-exfiltration vector
112# (⚠️ Use short-lived keys (-t) for shared/bastion hosts. Remove keys when done: ssh-add -d ~/.ssh/id_rsa)
113
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 112CWE-552
▾
110# Set key lifetime (seconds)
111ssh-add -t 3600 ~/.ssh/id_rsa
112# (⚠️ Use short-lived keys (-t) for shared/bastion hosts. Remove keys when done: ssh-add -d ~/.ssh/id_rsa)← sensitive path — credential-exfiltration vector
113
114# (⚠️ Always remove keys from agent when done: ssh-add -D to clear all, or ssh-add -d to remove specific keys.)
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 191CWE-552
▾
189## Configuration
190
191### SSH config file (`~/.ssh/config`)← sensitive path — credential-exfiltration vector
192```
193# Simple host alias
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 203CWE-552
▾
201 HostName prod.example.com
202 User deploy
203 IdentityFile ~/.ssh/id_prod← sensitive path — credential-exfiltration vector
204 ForwardAgent yes # (⚠️ Only forward to hosts you fully trust. The remote server can use your identities to authenticate elsewhere.)
205
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 381CWE-552
▾
379# (⚠️ Run ssh-keyscan independently first, compare the output against a trusted key
380# obtained via another channel (e.g., admin console, PGP-signed key page). Only then append:
381ssh-keyscan -t ed25519 hostname >> ~/.ssh/known_hosts← sensitive path — credential-exfiltration vector
382# If the scanned key doesn't match the trusted key, DO NOT append it.)
383
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 401CWE-552
▾
399
400# Check permissions
401ls -la ~/.ssh/← sensitive path — credential-exfiltration vector
402# Should be: 700 for ~/.ssh, 600 for keys, 644 for .pub files
403```
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 409CWE-552
▾
407# Fix permissions
408chmod 700 ~/.ssh
409chmod 600 ~/.ssh/id_rsa← sensitive path — credential-exfiltration vector
410chmod 644 ~/.ssh/id_rsa.pub
411chmod 644 ~/.ssh/authorized_keys
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 410CWE-552
▾
408chmod 700 ~/.ssh
409chmod 600 ~/.ssh/id_rsa
410chmod 644 ~/.ssh/id_rsa.pub← sensitive path — credential-exfiltration vector
411chmod 644 ~/.ssh/authorized_keys
412
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 411CWE-552
▾
409chmod 600 ~/.ssh/id_rsa
410chmod 644 ~/.ssh/id_rsa.pub
411chmod 644 ~/.ssh/authorized_keys← sensitive path — credential-exfiltration vector
412
413# Clear known_hosts entry
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 445CWE-552
▾
443```bash
444# Master connection (creates multiplexed session)
445ssh -M -S ~/.ssh/control-%r@%h:%p user@hostname← sensitive path — credential-exfiltration vector
446
447# Reuse existing connection
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 448CWE-552
▾
446
447# Reuse existing connection
448ssh -S ~/.ssh/control-user@hostname:22 user@hostname← sensitive path — credential-exfiltration vector
449
450# (⚠️ Control sockets are stored on disk. On shared systems, ensure ~/.ssh has 700 permissions.
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 455CWE-552
▾
453# In config (recommended approach):
454# ControlMaster auto
455# ControlPath ~/.ssh/control-%r@%h:%p← sensitive path — credential-exfiltration vector
456# ControlPersist 10m
457
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 480CWE-552
▾
478
479- Use SSH keys instead of passwords
480- Use `~/.ssh/config` for frequently accessed hosts← sensitive path — credential-exfiltration vector
481- Enable SSH agent forwarding carefully (security risk)
482- Use ProxyJump for accessing internal networks
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/ssh-essentials