Windows Remote

Control remote Windows machines via SSH. Use when executing commands on Windows, checking GPU status (nvidia-smi), running scripts, or managing remote Windows systems. Triggers on "run on Windows", "execute on remote", "check GPU", "nvidia-smi", "远程执行", "Windows 命令".

This skill appears to do exactly what it claims: run SSH/SCP commands against a configured Windows host. Before installing, ensure you: (1) only point WINDOWS_SSH_HOST and WINDOWS_SSH_USER at machines you trust, (2) protect your SSH private key (use key files with tight permissions), (3) be aware the scripts disable host-key checking (StrictHostKeyChecking=no) which makes MITM attacks easier — consider enabling host-key checking if you can, and (4) remember the skill can run arbitrary commands on the configured host, so do not expose it to untrusted networks or machines.

Type: OpenClaw Skill Name: windows-remote Version: 1.0.0 This skill is classified as suspicious due to its broad remote execution and file transfer capabilities via SSH/SCP, which inherently involve high-risk operations. A key concern is the use of `-o StrictHostKeyChecking=no` in all SSH and SCP commands (`scripts/win-download.sh`, `scripts/win-exec.sh`, `scripts/win-upload.sh`), which disables host key verification and makes connections vulnerable to Man-in-the-Middle attacks. While these capabilities are aligned with the stated purpose of remote Windows control, this specific security configuration significantly lowers the security posture, making the skill risky without clear malicious intent.