VPS Command Runner

Run commands across multiple VPS simultaneously. Execute SSH commands, deploy updates, check logs, and manage services across all your servers from one place...

This skill will run arbitrary SSH commands on multiple servers, which fits its purpose, but it currently encourages insecure practices: it asks you to hardcode a username/password in the scripts, uses sshpass, and disables SSH host-key checking. Before installing or using it: (1) do not paste real passwords into these files — remove PASS and use SSH key auth or an SSH agent; (2) prefer key-based auth (ssh -i /path/to/key) and use ssh-copy-id to deploy keys; (3) re-enable host key checking or explicitly manage known_hosts to avoid MITM risk; (4) validate or install required binaries (ssh, sshpass if you insist, docker) and update the skill metadata to declare them; (5) inspect and run the scripts in a safe environment (non-production) first; (6) consider using established tools (Ansible, parallel-ssh) that handle credentials and auditing more securely. If you cannot or will not change the scripts to use keys and proper host verification, treat this skill as unsafe for production credentials or sensitive servers.

Type: OpenClaw Skill Name: vps-command-runner Version: 1.0.0 The skill bundle provides scripts (run-all.sh, run.sh, status.sh) that facilitate remote command execution across multiple servers using sshpass with plaintext credentials and the 'StrictHostKeyChecking=no' flag. This implementation is highly insecure as it exposes passwords in the process list/files and bypasses SSH host identity verification, making the system vulnerable to Man-in-the-Middle attacks. While these are functional vulnerabilities rather than intentional malware, the high-risk nature of managing a VPS fleet with such insecure methods warrants a suspicious classification.