sshexec

A skill to execute SSH commands on remote servers, supporting both password and key-based authentication. It includes error handling and logging for command...

This skill appears to do what it says, but exercise normal SSH security hygiene before installing or using it: avoid passing passwords on the command line (use SSH agent or protected key files instead), protect private key files and their passphrases, be mindful that command output is logged (may contain secrets), and prefer enabling --strict-host-key to detect MITM. Because the package source is 'unknown', only run this on trusted machines and review or sandbox the script first; install paramiko from the official PyPI repository and verify integrity before use.

Type: OpenClaw Skill Name: sshexec Version: 1.0.1 The `sshexec` skill is designed to execute arbitrary SSH commands on remote servers, a powerful capability that, while aligned with its stated purpose, inherently carries significant risk. The `ssh_exec.py` script uses `paramiko.AutoAddPolicy()` by default for SSH host keys, which is a known vulnerability as it automatically trusts unknown host keys, making it susceptible to Man-in-the-Middle (MITM) attacks if not explicitly overridden with `--strict-host-key`. While the skill does not exhibit explicit malicious intent like data exfiltration or local persistence, its core functionality of remote command execution combined with a less secure default for host key verification makes it suspicious due to the potential for misuse and security flaws.