Rssh2 - SSH远程自动化工具

SSH远程自动化工具 - 会话管理、隧道、文件传输。使用场景：需要远程执行命令、建立SSH隧道、传输文件时。

This package appears to implement the advertised SSH features, but review before use: 1) Audit the code yourself (or have a dev review) — there are coding bugs (e.g., timeout handlers reference stream before it is defined) that can cause crashes. 2) Ensure dependencies are installed from a trusted registry (package.json lists ssh2 but no install spec was supplied). 3) Be cautious with credentials and file paths — the code will read private key files and scan local directories you pass; never run test.js with real credentials against sensitive hosts. 4) Because the tool can create dynamic SOCKS tunnels and port forwards, use it only on hosts/networks you control and avoid giving it root or highly privileged accounts. 5) If you will deploy this skill, run it in an isolated environment first (sandbox/container) and consider vendor-signing or integrity checks on npm packages.

Type: OpenClaw Skill Name: rssh2 Version: 1.0.1 The OpenClaw skill 'rssh2' is classified as suspicious due to its inherent capabilities for remote command execution, arbitrary file transfer, and network tunneling, all of which accept user-controlled inputs without internal sanitization. Specifically, `index.js` and `session-manager.js` directly pass commands to `ssh2.Client.exec`, posing a shell injection risk if the calling agent provides unsanitized input. The `sftp-manager.js` allows reading/writing to arbitrary local and remote file paths via `sftp.fastPut` and `sftp.fastGet`, creating path traversal vulnerabilities. Additionally, `tunnel-manager.js` can establish network tunnels to arbitrary hosts and ports. While these are core features of an SSH automation tool, their powerful nature and reliance on external input sanitization make the skill high-risk if misused, classifying it as suspicious rather than benign. There is no evidence of intentional malicious behavior, data exfiltration, or backdoors within the skill's code or instructions; in fact, `SKILL.md` provides good security advice.