Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent SSH administration guide, but it enables high-impact remote and fleet-wide changes without explicit safeguards or confirmation guidance.
Install only if you intend to let the agent administer SSH-accessible systems. Before using it, require explicit approval for package installs/upgrades, service restarts, file changes, and bulk commands; start with read-only checks or a single canary host; and verify how the SSH MCP server stores private keys, connection profiles, sessions, and logs.
The skill includes system-impacting command examples such as package upgrades without any explicit warning, confirmation requirement, or guidance to verify maintenance windows and rollback plans. In an agent skill that enables direct remote execution over SSH, such examples can normalize disruptive actions and increase the likelihood of unintended service impact or outage if copied verbatim.
The bulk execution section demonstrates fleet-wide remote command execution and service restarts/status checks without an explicit warning about blast radius, staging, or confirmation. In this context, omission of safeguards is more dangerous because the skill is specifically designed for concurrent execution across multiple hosts, so a mistaken or unsafe command can rapidly affect an entire fleet.
No suspicious patterns detected.
