remote-terminal

Remote Linux terminal control skill. Use when the user wants to (1) connect to a remote Linux server and execute commands, (2) perform SSH operations on remo...

This skill does what it says (remote command execution) but uses several insecure patterns you should be aware of before installing: it supports sshpass and Telnet (plaintext passwords), it allows storing passwords in ~/.qclaw/workspace/memory/hosts.json (plaintext), and it uses StrictHostKeyChecking=accept-new (auto-accepts host keys, which can enable MITM attacks). Before installing or using it: (1) review the scripts yourself and remove or modify the plaintext-password storage and sshpass flows; (2) prefer SSH key auth and avoid Telnet; (3) change or remove options that auto-accept host keys; (4) secure the ~/.qclaw directory (restrict permissions) and rotate any credentials added; (5) consider running this in a constrained environment or disable autonomous invocation if you do not want the agent to call it without explicit consent. If you want, I can point out the exact lines to change to harden the code (e.g., disable password storage, require explicit host-key verification, or encrypt stored secrets).

Type: OpenClaw Skill Name: remote-terminal Version: 1.0.0 The 'remote-terminal' skill provides powerful capabilities for remote server management, including SSH/Telnet command execution and parallel execution across multiple hosts. While it includes safety features like command logging and confirmation prompts for dangerous patterns (in ssh_exec.py and SKILL.md), it handles high-risk data such as SSH keys and host credentials. A significant security concern is found in host_manager.py, which allows storing remote server passwords in plaintext within a local JSON file (~/.qclaw/workspace/memory/hosts.json). Although the behavior aligns with the stated purpose, the combination of broad shell access and insecure credential handling makes it high-risk.