Security checks across malware telemetry and agentic risk
This is a real SSH key management skill, but it needs review because it can change access on many servers and installs a persistent Web UI with unsafe defaults.
Install only if you intentionally want this skill to administer SSH access across your servers. Before using it, review the server list and credential files, disable or harden the Web UI unless needed, bind it to 127.0.0.1, require explicit confirmation for both enable and disable operations, and avoid disabling SSH host key verification in production.
# Use printf which is safer than echo for arbitrary content
cmd = f"printf '%s\\n' '{safe_pub_key}{safe_comment}' >> ~/.ssh/authorized_keys"
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',try:
# 1. Create .ssh directory (using list arguments - safe)
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',# Use printf which is safer than echo for arbitrary content
cmd = f"printf '%s\\n' '{safe_pub_key}{safe_comment}' >> ~/.ssh/authorized_keys"
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',)
# 3. Set permissions (using list arguments - safe)
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',timeout=30
)
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',env['SSHPASS'] = password
try:
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',timeout=30
)
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null','-o', f'Port={port}',
user_host, 'test', '-f', '~/.ssh/authorized_keys']
test_result = subprocess.run(check_cmd, env=env, capture_output=True, timeout=15)
if test_result.returncode != 0:
print(f" {YELLOW}⚠️ authorized_keys not found, nothing to remove{NC}")'-o', f'Port={port}',
user_host, 'grep', '-F', key_data, '~/.ssh/authorized_keys']
grep_result = subprocess.run(grep_cmd, env=env, capture_output=True, timeout=15)
if grep_result.returncode != 0:
print(f" {YELLOW}⚠️ Key not found in authorized_keys, nothing to remove{NC}")# When all lines are filtered, grep -Fv returns 1 and outputs nothing
remove_cmd = f"KEY_DATA=$(echo '{key_b64}' | base64 -d); grep -Fv \"$KEY_DATA\" ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp ; mv ~/.ssh/authorized_keys.tmp ~/.ssh/authorized_keys"
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',)
# 4. Set permissions
subprocess.run(
['sshpass', '-e', 'ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',)
# 5. Verify key is removed
verify_result = subprocess.run(grep_cmd, env=env, capture_output=True, timeout=15)
if verify_result.returncode != 0:
print(f" {GREEN}✅ Key removed successfully{NC}")'-i', str(key_path),
user_host, 'test', '-f', '~/.ssh/authorized_keys']
test_result = subprocess.run(check_cmd, capture_output=True, timeout=15)
if test_result.returncode != 0:
print(f" {YELLOW}⚠️ authorized_keys not found, nothing to remove{NC}")'-i', str(key_path),
user_host, 'grep', '-F', key_data, '~/.ssh/authorized_keys']
grep_result = subprocess.run(grep_cmd, capture_output=True, timeout=15)
if grep_result.returncode != 0:
print(f" {YELLOW}⚠️ Key not found in authorized_keys, nothing to remove{NC}")key_b64 = base64.b64encode(key_data.encode()).decode()
remove_cmd = f"KEY_DATA=$(echo '{key_b64}' | base64 -d); grep -Fv \"$KEY_DATA\" ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp ; mv ~/.ssh/authorized_keys.tmp ~/.ssh/authorized_keys"
subprocess.run(
['ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',)
# 4. Set permissions
subprocess.run(
['ssh',
'-o', 'StrictHostKeyChecking=no',
'-o', 'UserKnownHostsFile=/dev/null',)
# 5. Verify key is removed
verify_result = subprocess.run(grep_cmd, capture_output=True, timeout=15)
if verify_result.returncode != 0:
print(f" {GREEN}✅ Key removed successfully{NC}")66/66 vendors flagged this skill as clean.