OC SSH Tunnel Node Recovery

Diagnose and recover OpenClaw node connectivity over SSH tunnel. Use for pairing-required errors, tunnel conflicts, wrong remote endpoint, and ssh target mis...

Security Scan

The instructions, inputs, and expected actions align with a troubleshooting skill for SSH tunnel node recovery; nothing requested or instructed is disproportionate to that purpose.

Purpose & Capability

The name/description (SSH tunnel node recovery) matches the SKILL.md procedure and the listed inputs (ssh-target, api-endpoint, gateway-credential, node id). All requested data and checks (process existence, local forward bound, endpoint locality, credential validity, probe/status re-check) are coherent with diagnosing SSH tunnel connectivity issues.

Instruction Scope

Instructions are scoped to diagnostics and remediation of SSH tunnels; they imply the agent will inspect local process/socket state and re-run probes (e.g., ps/ss/netstat, ssh -L/ssh control commands, api probes). The SKILL.md does not prescribe exact commands, so the agent will have discretion — this is reasonable for a troubleshooting skill but grants the agent the ability to run system/network checks at runtime. The safety section appropriately instructs masking sensitive values.

Install Mechanism

No install spec and no code files (instruction-only) — minimal risk because nothing is written to disk or automatically fetched at install time.

Credentials

The skill expects a gateway-credential input at runtime but declares no required environment variables or primary credential in metadata. This is not necessarily wrong (inputs can be provided interactively), but users should be aware the skill will ask for sensitive credentials to validate gateway auth. No unrelated credentials or config paths are requested.

Persistence & Privilege

always is false and there is no install-time persistence. The skill does not request elevated or permanent agent privileges.

Assessment

This skill appears to do what it says: SSH-tunnel troubleshooting. Before using it, confirm you trust the skill's source (no homepage or owner reputation is provided), and avoid supplying production credentials until you validate behavior. Prefer providing short-lived or test gateway credentials, and monitor any logs/output to ensure secrets are masked. If you need stronger assurance, ask the author for concrete command examples the agent will run (so you can review them) or require that the skill only output sanitized placeholders as its safety note requests.

When to use

• gateway closed (1008): pairing required
• cannot listen to port / Address already in use
• remote endpoint unreachable after migration
• node can connect intermittently but status is unstable

Inputs expected

• <ssh-target>
• <api-endpoint>
• <gateway-credential>
• target node id/name

Procedure

1. Validate tunnel process exists and local forward is bound.
2. Verify endpoint is tunnel-local and not public plaintext.
3. Verify ssh target maps to correct gateway host.
4. Verify credential is present and matches gateway auth mode.
5. Re-run probe then status check; record outcome.

Deliverable format

• Root cause (single sentence)
• Fixes applied (ordered list)
• Verification evidence (probe/status snippets)
• Residual risk and next action

Safety

• Never expose real IP/domain/path/credential in external reports.
• Use placeholders for all network and identity fields.