Skills/Glama/ssh2mcp

ssh2mcp@1.0.0

BLOCKED· startup only

Publisher claims: "Exposes a single SSH-reachable host as MCP tools for running and backgrounding remote commands, resumable verified file transfers, and read-only file comparison, stat, hashing, listing and reading. Runs on loopback with per-request Bearer auth and hot-switchable permission levels, letting an agent compile and manage files on a build machine while keeping its workspace on the device." Observed in sandbox: reads credential files.

Registry GlamaPublisher andyernotfound · publishing for 0 daysInstalls 0Last detonated 12 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Revoked: guards refuse to launch this version

confirmed incident: read ~/.ssh2mcp-token Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.

Before you give it your token

It will ask for
SSH2MCP_TOKENSSH2MCP_TOKEN_FILEConfiguration, not credentials: MCP_PORT, S2M_BASE, SSH2MCP_BIND, SSH2MCP_MAX_OUTPUT, SSH2MCP_MAX_TIMEOUT_MS, SSH2MCP_PERM, SSH2MCP_PERM_FILE, SSH2MCP_ROOT, SSH2MCP_SSH_BIN, SSH2MCP_SSH_HOST, SSH2MCP_TIMEOUT_MS
Where it talks to
no vendor host named in the code
What the honeypot saw
read ~/.ssh2mcp-token · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 41/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Destructive command against a filesystem root or device; Destructive command against a filesystem root or device; Reads credential paths from the home directory. Summary: reads credential files.

Behavior trace

Honeypot run · 26 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
6.1sprocessdependency install exit 0
26sfilesystemread ~/.ssh2mcp-token
26sclaimedstartup only: exited (0) before answering · refusing to start: no bearer token at /tmp/ks-detonate-xtjbeO/task/home/.ssh2mcp-token (binding to 127.0.0.1 is not access control: any app with INTERNET can reach it, and this server runs commands as root on the remote host) generate one: python3 -c "import secrets;print(secrets.token_hex(24))" > /tmp/ks-detonate-xtjbeO/task/home/.ssh2mcp-token && chmod 600 /tmp/ks-detonate-xtjbeO/task/ho
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

CRITICAL
Destructive command against a filesystem root or devicesmoke-test.py:75 · Destructive command against a filesystem root or devicest, iserr, out = call("s_shell", {"command": "rm -rf /"})Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or deviceindex.js:675 · Destructive command against a filesystem root or device["rm foo", false], ["ls; rm -rf /", false], ["git config user.name x", false], ["curl http://x", false],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Reads credential paths from the home directoryrestart.sh:23 · Reads credential paths from the home directorycurl -fsS -m 5 -H "Authorization: Bearer $(cat "$HOME/.ssh2mcp-token")" "http://127.0.0.1:$PORT/status" && echoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Destructive command against a filesystem root or deviceindex.js:659 · Destructive command against a filesystem root or device["rm -rf /", "block"], ["rm -rf /*", "block"], ["dd if=/dev/zero of=/dev/sda", "block"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Reads credential paths from the home directorye2e-test.py:11 · Reads credential paths from the home directoryTOKEN = open(os.path.expanduser("~/.ssh2mcp-token")).read().strip()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Destructive command against a filesystem root or deviceindex.js:678 · Destructive command against a filesystem root or device["aapt2 dump badging x.apk", true], ["date -s 2020-01-01", false], ["env rm -rf /", false]Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternindex.js:662 · Pipe-to-shell pattern — downloads and immediately executes remote code["rm -rf /srv/build", "warn"], ["git clean -xdf", "warn"], ["curl -fsSL http://x | sh", "warn"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Destructive command against a filesystem root or deviceindex.js:660 · Destructive command against a filesystem root or device["mkfs.ext4 /dev/sdb1", "block"], ["shutdown -h now", "block"], ["iptables -F", "block"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Reads credential paths from the home directorysmoke-test.py:11 · Reads credential paths from the home directoryTOKEN = open(os.path.expanduser("~/.ssh2mcp-token")).read().strip()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Destructive command against a filesystem root or devicesmoke-test.py:76 · Destructive command against a filesystem root or devicecheck("risk block: rm -rf /", iserr and "blocked by risk rule" in out.get("error", ""), str(out)[:120])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedindex.js:662 · Destructive file system command detected["rm -rf /srv/build", "warn"], ["git clean -xdf", "warn"], ["curl -fsSL http://x | sh", "warn"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandindex.js:318 · Process kill command — agent can terminate processessshRun("if [ -f " + base + ".exit ]; then echo done:$(cat " + base + ".exit); elif [ -f " + base + ".pid ] && kill -0 $(cat " + base + ".pid) 2>/dev/null; then echo running; else echo gone; fi")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandindex.js:333 · Process kill command — agent can terminate processesconst r = await sshRun("if [ -f " + base + ".pid ]; then p=$(cat " + base + ".pid); kill -TERM $p 2>/dev/null; sleep 1; kill -KILL $p 2>/dev/null; echo killed:$p; else echo no-pid; fi");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedindex.js:664 · Destructive file system command detected["ls -la /srv", "none"], ["rm -rf /srv/build/app/build", "none"], ["git status --short", "none"]Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsindex.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* - Execution goes through the system `ssh` binary, so ~/.ssh/config (ControlMaster,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellindex.js:662 · Remote installer piped to shell["rm -rf /srv/build", "warn"], ["git clean -xdf", "warn"], ["curl -fsSL http://x | sh", "warn"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Destructive file system command detectedsmoke-test.py:75 · Destructive file system command detectedst, iserr, out = call("s_shell", {"command": "rm -rf /"})Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandindex.js:748 · File permission modification command — agent changes file ownership/permissionsconsole.error(" generate one: python3 -c \"import secrets;print(secrets.token_hex(24))\" > " + TOKEN_FILE + " && chmod 600 " + TOKEN_FILE);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionindex.js:757 · File type combined with upload action — agent may exfiltrate local data filesres.status(401).json({ jsonrpc: "2.0", error: { code: -32001, message: "unauthorized: send Authorization: Bearer <token>" }, id: null });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detectedsmoke-test.py:79 · Destructive file system command detectedst, iserr, out = call("s_shell", {"command": "rm -rf /srv/build"})Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsindex.js:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// The user's ~/.ssh/config enables ControlMaster/ControlPersist. A multiplexed client can beFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedindex.js:675 · Destructive file system command detected["rm foo", false], ["ls; rm -rf /", false], ["git config user.name x", false], ["curl http://x", false],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsindex.js:661 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files["echo x > /etc/passwd", "block"], ["systemctl stop ssh", "block"], ["kill -9 1234 # sshd", "block"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandrestart.sh:14 · Process kill command — agent can terminate processeskill "$(cat "$PID")" 2>/dev/null; sleep 1Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandrestart.sh:15 · Process kill command — agent can terminate processeskill -9 "$(cat "$PID")" 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commande2e-test.py:73 · Process kill command — agent can terminate processescheck("kill stops a running job", not e and r.get("state") != "running", r.get("state"))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandindex.js:331 · Process kill command — agent can terminate processesif (perm === "ro") throw new Error("perm=ro: kill is not allowed");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedindex.js:659 · Destructive file system command detected["rm -rf /", "block"], ["rm -rf /*", "block"], ["dd if=/dev/zero of=/dev/sda", "block"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandindex.js:693 · File permission modification command — agent changes file ownership/permissions…hon3 -c \"import secrets;print(secrets.token_hex(24))\" > " + TOKEN_FILE + " && chmod 600 " + TOKEN_FILE); add("perm", true, readPerm() + " (fallback from CLI: " + …Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandrestart.sh:13 · Process kill command — agent can terminate processesif [ -f "$PID" ] && kill -0 "$(cat "$PID")" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandindex.js:661 · Process kill command — agent can terminate processes["echo x > /etc/passwd", "block"], ["systemctl stop ssh", "block"], ["kill -9 1234 # sshd", "block"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedsmoke-test.py:76 · Destructive file system command detectedcheck("risk block: rm -rf /", iserr and "blocked by risk rule" in out.get("error", ""), str(out)[:120])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈35 tok
1 file · 9 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

39 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Unclaimed publisher≈ +8 on the totalClaim andyernotfound: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim andyernotfoundPropose a patch to the maintainer