Auto Deploy

This skill appears to implement real deployment behavior but contains several red flags. Before installing or running it: - Do not enable broad 'elevated' agent permissions until you audit the code. The README asks you to allow the agent to run git/ssh/scp/npm/mvn/tar which grants high capability. - Inspect and remove any hardcoded credentials. The package includes plaintext usernames/passwords and a server IP (e.g., 'zhangjiamin' and 192.168.1.168). Treat those as leaked if they are real: rotate/change those passwords and keys on the remote systems immediately. - Prefer SSH-key based authentication stored securely (not committed in files). Replace password-based expect/sshpass flows with key-based or vault-backed secrets. - Avoid using root for deployment; use a dedicated, minimally privileged deploy user and restrict allowed commands on that account. - Audit scripts that modify authorized_keys and those that print private data (show-ssh-config.js prints password). Remove any code that reveals secrets to logs or stdout. - Run the skill only in a controlled/sandbox environment first (or on an isolated test server) to observe behavior. If you must use it in production, perform a full code review and sanitize deploy-config.json and other files, then apply principle of least privilege on the remote server. If you need help hardening this package, consider asking the author for a version that uses: no embedded credentials, explicit support for secret stores or environment variables, key-based SSH only, and a non-root deploy user. Also request provenance (source/homepage) — currently the skill's source is unknown.