ClawHub
Back to skill

Security audit

Github Private Repo SSH Routing

Security checks across malware telemetry and agentic risk

Overview

This is a coherent GitHub SSH routing helper whose main risk is that its local audit output can reveal private repository and SSH configuration details.

Install only if you need help diagnosing GitHub SSH routing. Run the audit locally, avoid posting raw output, and redact host aliases, usernames, repository URLs, key file names, HostName values, and proxy/jump-host settings before sharing logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script prints the first 200 lines of ~/.ssh/config directly to stdout, which can expose sensitive host aliases, internal hostnames, usernames, key paths, proxy/jump-host settings, and other connection metadata. In an agent or automated support context, that output may be logged, forwarded, or shown to a third party, creating an avoidable disclosure risk even though it does not reveal private key material itself.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.