remote-server-guide

SUSPICIOUS. The skill’s core capabilities match its stated SSH/remote-admin purpose, so it is not fundamentally deceptive or malicious. But its footprint is high-risk by design: it enables arbitrary remote execution and file transfer, recommends disabling host-key verification, forwards passwords to tools like sshpass/Paramiko/Fabric, and includes a stale third-party brew tap for sshpass. Data flows remain direct to user-specified hosts rather than attacker infrastructure, so this looks like a risky but purpose-aligned admin skill, not confirmed malware.

The excerpt presents legitimate but high-privilege remote administration examples. It does not provide evidence of intentional malware. Its main security concerns are disabled SSH host-key verification, illustrative hardcoded passwords, and shell command construction without safe quoting or validation. Assessment is limited to the visible excerpt.