The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/ssh-tunnel.sh constructs and executes SSH commands using variables that are not consistently quoted. For instance, the run_ssh function executes $ssh_opts without quotes, which allows for word splitting and potentially arbitrary command injection if the underlying configuration source or the input parameters contain shell metacharacters. The use of # shellcheck disable=SC2086 in start_tunnel confirms that word splitting is intentionally enabled for these variables, which is a high-risk pattern when handling external inputs.
[CREDENTIALS_UNSAFE]: The script uses sshpass -p "$password" to handle SSH authentication. This method is insecure because the password is passed as a command-line argument, making it visible to other users and processes on the same system (e.g., via the ps command or in system logs).
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied port forwarding specifications and profile names that are directly interpolated into shell commands. This creates an indirect prompt injection surface if the agent is instructed to use this skill on untrusted data.
Ingestion points: Arguments like <profile> and port specifications (<lport>:<rhost>:<rport>) in SKILL.md and scripts/ssh-tunnel.sh.
Boundary markers: None identified in the provided files.
Capability inventory: Subprocess calls to ssh, sshpass, and python across all functions in scripts/ssh-tunnel.sh.
Sanitization: Minimal validation is performed (basic non-empty checks), leaving the script vulnerable to maliciously crafted strings containing shell metacharacters.

ssh-dev-suite/tunnel