SSH Handoff

Create and reuse a secure shared terminal handoff when a human must authenticate first and the agent must resume work in the same shell session afterward. Us...

This skill appears to implement what it says, but take these precautions before using it: - Verify provenance: the package has no homepage and an unknown source; review all included scripts yourself before running. - Ensure required binaries (tmux, ttyd, node, python3) are installed from trusted packages; the registry metadata does not list them even though SKILL.md and scripts require them. - Never bind the proxy to a public interface or 0.0.0.0 unless you explicitly accept the risk; prefer 127.0.0.1 or a restricted LAN address. - When using LAN mode set EXPECTED_HOST/EXPECTED_ORIGIN and/or CLIENT_IP to restrict access, and apply firewall rules (UFW_ALLOW_CMD shown by the launcher). - Treat the one-shot URL/token as sensitive and deliver it to the human out-of-band (not via public chat). - Confirm the tmux pane state with tmux capture-pane before the agent issues any commands. - Run the scripts in a controlled environment (non-production host or with a retained snapshot) until you’ve audited them. If you want higher confidence, ask the publisher for source provenance or a signed release, or run the scripts in an isolated test VM to observe behavior before using on important hosts.

Type: OpenClaw Skill Name: ssh-handoff Version: 1.0.1 The skill provides a mechanism for an AI agent to resume work in a terminal session after a human has performed sensitive authentication, using tmux and ttyd. It includes a Node.js proxy (scripts/url-token-proxy.js) and launchers (scripts/start-url-token-web-terminal.sh) that implement security features such as one-shot URL tokens, IP-based access filtering, Host/Origin header validation, and automatic TTL-based cleanup. While the code is well-documented and includes defensive instructions for the agent in SKILL.md, the core functionality of exposing a shell session via a web interface (even if restricted to localhost or LAN) is an inherently high-risk capability. Per the analysis criteria, such risky capabilities are classified as suspicious even when they align with the stated purpose and lack evidence of malicious intent.