ssh
https://raw.githubusercontent.com/openhands/skills/main/skills/ssh/SKILL.md
github.com/openhands/skills
Scanned Thu, 28 May 2026 17:30:30 GMT
Scan ID crawl-qwvdpvyizdkvpb7o8yzc6ff6 · 1ms
C
SCORE 55 / 100
Verdict: Proceed with caution

10 high-severity findings.

This skill reads protected filesystem locations plus 10 other issues listed below.

0 critical10 high1 medium1 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 10 high-severity findings (3+ HIGHs → C).

0 CRIT10 HIGH1 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 8 of 10 HIGH (cap is 2).

  • A
    Reach Atarget score 95

    Resolve all 10 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 41CWE-552
▾
39Generate a new SSH key pair:
40```bash
41ssh-keygen -t ed25519 -f ~/.ssh/key_name -C "comment" -N ""← sensitive path — credential-exfiltration vector
42```
43
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 46CWE-552
▾
44Copy the public key to the remote server:
45```bash
46ssh-copy-id -i ~/.ssh/key_name.pub username@hostname← sensitive path — credential-exfiltration vector
47```
48
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 51CWE-552
▾
49Connect using the private key:
50```bash
51ssh -i ~/.ssh/key_name username@hostname← sensitive path — credential-exfiltration vector
52```
53
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 59CWE-552
▾
57```bash
58mkdir -p ~/.ssh
59cat > ~/.ssh/config << 'EOF'← sensitive path — credential-exfiltration vector
60Host alias
61 HostName hostname_or_ip
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 63CWE-552
▾
61 HostName hostname_or_ip
62 User username
63 IdentityFile ~/.ssh/key_name← sensitive path — credential-exfiltration vector
64 Port 22
65 ServerAliveInterval 60
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 67CWE-552
▾
65 ServerAliveInterval 60
66EOF
67chmod 600 ~/.ssh/config← sensitive path — credential-exfiltration vector
68```
69
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 111CWE-552
▾
109Add a key to the agent:
110```bash
111ssh-add ~/.ssh/key_name← sensitive path — credential-exfiltration vector
112```
113
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 119CWE-552
▾
117- Verify SSH port is open: `nc -zv hostname 22`
118- Debug connection issues: `ssh -vvv username@hostname`
119- Check permissions: SSH private keys should have 600 permissions (`chmod 600 ~/.ssh/key_name`)← sensitive path — credential-exfiltration vector
120- Verify known_hosts: If host key changed, remove the old entry with `ssh-keygen -R hostname`
121
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 130CWE-552
▾
128```bash
129# Set correct permissions for private keys
130chmod 600 ~/.ssh/id_ed25519← sensitive path — credential-exfiltration vector
131# Set correct permissions for public keys
132chmod 644 ~/.ssh/id_ed25519.pub
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 132CWE-552
▾
130chmod 600 ~/.ssh/id_ed25519
131# Set correct permissions for public keys
132chmod 644 ~/.ssh/id_ed25519.pub← sensitive path — credential-exfiltration vector
133# Set correct permissions for SSH directory
134chmod 700 ~/.ssh
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-qwvdpvyizdkvpb7o8yzc6ff6