Caveat verdict
rssh2
SSH automation tool with documented connection pooling, tunneling, and SFTP features; explicitly advises against hardcoding credentials and uses key-file paths, all consistent with legitimate remote infrastructure management.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (5)
Uses exec() — may execute shell commands
SKILL.md · code · exec(
Accesses .ssh directory
SKILL.md · code · .ssh/
Possible hardcoded credential
test.js · prose · downgraded · password: 'your-password
Dynamic import() — loads module at runtime
index.js · prose · downgraded · import('
References tunneling service
tunnel-manager.js · prose · downgraded · LocalTunnel
Permissions & capabilities
No declared permissions — minimal attack surface.
process_execcredential_store Is this flag fair?
Thanks — recorded.