ssh-server-admin
Warn
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to pass user passwords as plaintext arguments in shell commands (e.g.,
sshpass -p '[password]'andpython scripts/ssh_helper.py --password [password]). This is a security risk as passwords become visible in the system's process list (e.g., viapsortopcommands). - [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands for SSH connectivity, remote administration (systemctl, journalctl), and file transfers (SCP/SFTP) based on user-provided input.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies, including the Python library
paramikovia pip and thesshpassutility via system package managers (apt, brew, yum). - [COMMAND_EXECUTION]: The skill relies on a local script
scripts/ssh_helper.pywhich is not provided in the source files, making its internal logic and safety unverified. - [CREDENTIALS_UNSAFE]: Use of
-o StrictHostKeyChecking=accept-newautomatically trusts new host keys, which provides convenience but reduces protection against Man-in-the-Middle (MitM) attacks during the initial connection.
Audit Metadata