Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only code-review skill for Wish SSH servers, and the credential-related examples are review guidance rather than hidden access or execution behavior.
Safe to install as a review aid. Treat its SSH key and password examples as documentation patterns to scrutinize rather than production-ready code, and prefer public-key authentication with securely stored host keys when applying the guidance.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// GOOD - complete server setup
s, err := wish.NewServer(
wish.WithAddress(fmt.Sprintf("%s:%d", host, port)),
wish.WithHostKeyPath(".ssh/id_ed25519"),
wish.WithMiddleware(
logging.Middleware(), // first: log all connections
activeterm.Middleware(), // handle terminal sizing
This documentation includes a concrete password-auth example that performs direct comparison against an environment variable, even though it is labeled 'not recommended for production.' In practice, readers often copy examples verbatim, and this pattern encourages weak password-based authentication, secret handling via environment variables, and likely omission of stronger controls such as key-based auth, hashing, rate limiting, or MFA.
This markdown file includes a server setup example with wish.WithHostKeyPath(".ssh/id_ed25519"), which involves loading sensitive SSH host key material. Under the markdown-file warning criterion, the skill description should disclose security-sensitive behaviors that affect credentials or system integrity, but no warning is provided near the example.
No suspicious patterns detected.