Github Private Repo SSH Routing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:02 PM UTC
• Version: 1.0.1

Overview

This is a coherent GitHub SSH troubleshooting skill, but its audit path prints broad SSH configuration metadata that can expose unrelated keys, hosts, and account details.

Review before installing. Run the audit script only in a private terminal, do not paste its output into public tickets or shared logs without redacting SSH host aliases, usernames, identity file paths, and proxy/jump-host details. Prefer alias-scoped checks such as `ssh -G <alias>` and inspect only the selected key path when possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/audit-routing.sh:37

Finding

Overbroad Disclosure of SSH Configuration and Identity Metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/audit-routing.sh:37-46, with equivalent diagnostic guidance in SKILL.md:92-93 and references/patterns.md:76-79
Vulnerability Type: Excessive access to credential-related configuration and disclosure of sensitive operational metadata
Risk Level: Medium

Vulnerable Code

scripts/audit-routing.sh:37-46:

bash

echo "== SSH files =="
ls -la ~/.ssh 2>/dev/null || echo "~/.ssh not found"
echo

echo "== SSH permissions =="
stat -c '%a %U:%G %n' ~/.ssh ~/.ssh/* 2>/dev/null || true
echo

echo "== SSH config preview =="
sed -n '1,200p' ~/.ssh/config 2>/dev/null || echo "~/.ssh/config not found"

Equivalent commands are recommended in references/patterns.md:76-79:

bash

ls -la ~/.ssh
stat -c '%a %U:%G %n' ~/.ssh ~/.ssh/* 2>/dev/null
sed -n '1,200p' ~/.ssh/config
git remote -v

SKILL.md:92-93 also recommends directly listing the SSH directory and printing the SSH configuration:

bash

ls -la ~/.ssh
sed -n '1,200p' ~/.ssh/config

Technical Analysis

The Skill is intended to diagnose SSH key routing for one Git repository and the SSH alias used by its origin remote. However, the bundled audit script enumerates every file under the user's SSH directory, reports ownership and permissions for every entry, and prints up to 200 lines of the complete SSH client configuration.

This collection is broader than necessary for repository-specific routing analysis. The SSH configuration can contain unrelated and security-sensitive operational metadata, including:

• Internal or external hostnames
• SSH usernames and nonstandard ports
• Private-key filenames and identity mappings
• Bastion or jump-host relationships
• ProxyCommand or ProxyJump configuration
• Organization-specific network topology
• Aliases associated with unrelated repositories or systems

The directory listing and permission report can also r ...[truncated 2370 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional full-directory listing and complete SSH configuration preview from the default audit path.

2. Restrict diagnostics to the host alias inferred from the repository remote. Use the effective SSH configuration already produced by:

   bash

   ssh -G "$alias_host"
   

   Report only fields required for routing analysis, such as hostname, user, port, identityfile, and identitiesonly.

3. After obtaining the selected identityfile, inspect only that specific path. Report whether it exists and whether its permissions meet the expected baseline. Do not enumerate unrelated files under ~/.ssh.

4. If raw SSH configuration inspection is necessary, require an explicit command-line option and informed user consent, for example:

   bash

   scripts/audit-routing.sh --include-ssh-config /path/to/repo
   

5. Redact sensitive values before printing or logging them. At minimum, redact unrelated hostnames, usernames, identity paths, ProxyCommand, ProxyJump, LocalForward, and RemoteForward values.

6. Update SKILL.md and references/patterns.md so their default diagnostic commands follow the same repository-scoped approach. Clearly warn users that raw SSH configuration may contain sensitive infrastructure metadata and should not be pasted into public tickets or shared logs.

7. Add a concise privacy warning to the script and documentation stating that diagnostic output can reveal remote URLs and SSH identity information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

scripts/audit-routing.sh /path/to/repo

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/identity-model-boundaries.md (reported line 3)May include surrounding context.

md

# Identity Model Boundaries

Use this file when deciding whether a GitHub automation task should use a deploy key, a fine-grained personal access token (PAT), a personal SSH key, or a machine user.

## Core distinction

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/key-storage-by-system.md (reported line 16)May include surrounding context.

md

Typical files:

- `~/.ssh/config`
- `~/.ssh/known_hosts`
- `~/.ssh/<private-key>`
- `~/.ssh/<private-key>.pub`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/key-storage-by-system.md (reported line 49)May include surrounding context.

IdentityFile ~/.ssh/github_backup_ed25519 IdentitiesOnly yes AddKeysToAgent yes UseKeychain yes

text

Avoid storing private keys in iCloud Drive, Desktop, or Documents.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/patterns.md (reported line 43)May include surrounding context.

Host github.com HostName github.com User git IdentityFile ~/.ssh/id_ed25519 IdentitiesOnly yes

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Listing ~/.ssh and printing file permissions reveals local key filenames and account metadata that users may consider sensitive. The script provides output labels but no explicit warning or opt-in disclosure that this local SSH information will be shown.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

fi

echo "== SSH files =="
ls -la ~/.ssh 2>/dev/null || echo "~/.ssh not found"
echo

echo "== SSH permissions =="

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/patterns.md (reported line 77)May include surrounding context.

md

fi

echo "== SSH files =="
ls -la ~/.ssh 2>/dev/null || echo "~/.ssh not found"
echo

echo "== SSH permissions =="

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · scripts/audit-routing.sh (reported line 38)May include surrounding context.

sh

fi

echo "== SSH files =="
ls -la ~/.ssh 2>/dev/null || echo "~/.ssh not found"
echo

echo "== SSH permissions =="

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script previews ~/.ssh/config, which can expose host aliases, usernames, ports, and identity file paths. Although the action is read-only, there is no confirmation prompt or disclosure warning that sensitive local configuration will be printed to the terminal.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.