Ssh Exec

Name: Ssh Exec
Author: lordmacu

BSecurity

Run shell commands on remote hosts via SSH, and transfer files via SCP. Allowlist-gated.

6 stars
0 votes
0 copies
2 views
Added June 14, 2026

ai-agentsrustshelldockerapi

Works with

Security analysis

B75/100

criticalAccesses sensitive system or user directories

Pro shows the line behind each finding and how to fix it

Scanned June 14, 2026

npx -y skills add lordmacu/nexo-rs --skill ssh-exec --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Ssh Exec?

Add the live security badge to your README. It updates with every re-scan.

[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/lordmacu-ssh-exec/badge)](https://www.skillsdirectory.com/skills/lordmacu-ssh-exec)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: SSH Exec
description: Run shell commands on remote hosts via SSH, and transfer files via SCP. Allowlist-gated.
requires:
  bins:
    - ssh
    - scp
  env:
    - SSH_EXEC_ALLOWED_HOSTS
---

# SSH Exec

Execute commands on remote Linux hosts through the system `ssh` client. Uses
key-based auth only (`BatchMode=yes` — no interactive password prompts). Hosts
must be explicitly allowlisted.

## Use when

- "Restart nginx on `prod01`"
- "Tail `/var/log/syslog` on `home-server`"
- Pushing / pulling a file to/from a known host
- Kate driving ops on other machines you administer

## Do not use when

- Persistent interactive sessions — use `tmux-remote`
- Containers on *this* host — use `docker-api`
- Arbitrary / untrusted hosts — allowlist is mandatory

## Tools

- `status` — allowlist + bin versions
- `exec` — `host`, `command`; optional `timeout_secs` (default 30, max 600), `identity_file`
- `scp_upload` — `host`, `local_path`, `remote_path`
- `scp_download` — `host`, `remote_path`, `local_path`

## Env

| Var | Required | Notes |
|-----|----------|-------|
| `SSH_EXEC_ALLOWED_HOSTS` | yes | comma-separated `user@host` or `~/.ssh/config` alias |
| `SSH_EXEC_ALLOW_WRITES` | for `scp_upload` | must be `"true"` |
| `SSH_EXEC_TIMEOUT_SECS` | no | default 30 |
| `SSH_BIN` / `SCP_BIN` | no | override binaries |

## Safety

- Non-allowlisted host → `-32041 host not allowed`
- `StrictHostKeyChecking=accept-new` — first connect auto-adds host key; subsequent changes fail
- `BatchMode=yes` — password-protected keys without agent will fail. Use `ssh-agent` or unencrypted deploy keys
- Writes gated: upload requires `SSH_EXEC_ALLOW_WRITES=true`. Download is read-only, ungated
- `stdout` truncated at 16 KB, `stderr` at 8 KB