Skills ssh-penetration-testing
📦
ssh-penetration-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Audit SSH Security Safely
SSH assessments can miss weak configuration, exposed keys, and tunnel risks. This skill structures authorized reviews with discovery, audit steps, and report-ready findings.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ssh-penetration-testing" from https://skillstore.io/skills/sickn33-ssh-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-ssh-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ssh-penetration-testing". Assess this SSH audit summary: OpenSSH 7.2, SHA1 MACs, password authentication enabled.
Expected outcome:
Findings: outdated OpenSSH requires patch review, SHA1 MACs should be disabled, and password authentication needs compensating controls.
Using "ssh-penetration-testing". Prepare a test plan for an authorized internal SSH review.
Expected outcome:
Plan: confirm scope, discover services, review configuration, check key exposure, protect evidence, and map each finding to remediation.
Using "ssh-penetration-testing". Summarize SSH tunnel risk for a change board.
Expected outcome:
Risk summary: Local, remote, and dynamic forwarding can bypass segmentation. Disable unused forwarding and monitor approved exceptions.
Security Audit
Criticalv5 • 7/9/2026 Open versioned report
The skill is highly dual-use and includes credential attacks, SSH key discovery, Metasploit usage, tunneling, pivoting, and post-exploitation actions. Markdown backtick detections and placeholder private IP findings were dismissed where they were only formatting or example targets. Confirmed findings show unacceptable risk for unsupervised marketplace publishing without major safety restructuring.
1
Files scanned
489
Lines analyzed
42
Review items
0
False positives ignored
Confirmed security concerns (55)
Critical
SSH directory access
~/.ssh/id_rsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
~/.ssh/id_dsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
~/.ssh/id_ecdsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
~/.ssh/id_ed25519
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
/root/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
/home/*/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
curl -s http://target.com/.ssh/id_rsa
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
ls -la ~/.ssh/
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Show all 55 confirmed findings
Critical
SSH directory access
cat ~/.ssh/known_hosts
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
cat ~/.ssh/authorized_keys
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH directory access
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The skill identifies or reads SSH directories and key files during exposed-key checks or post-exploitation. These locations can contain secrets and trust material.
Critical
SSH private key file
ssh -i id_rsa user@192.168.1.100
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
ssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
for key in id_rsa id_dsa id_ecdsa id_ed25519; do
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
~/.ssh/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
~/.ssh/id_dsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
~/.ssh/id_ecdsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
~/.ssh/id_ed25519
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
curl -s http://target.com/.ssh/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
curl -s http://target.com/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
find / -name "id_rsa" 2>/dev/null
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
find / -name "id_dsa" 2>/dev/null
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH private key file
set KEY_FILE /path/to/id_rsa
The reference is to private key files used for login attempts, key discovery, web retrieval, filesystem search, or Metasploit key authentication. Private keys are sensitive credentials.
Critical
SSH host/auth files
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The command appends a key to authorized_keys under an add-persistence heading. That creates unauthorized persistent access if misused.
Critical
Crypto seed/private key mention
# Attempt login with found private key
The private key mention appears in found-key login or key-location guidance. That supports use or discovery of sensitive credential material.
Critical
Crypto seed/private key mention
# Common locations for private keys
The private key mention appears in found-key login or key-location guidance. That supports use or discovery of sensitive credential material.
Critical
Metasploit framework
- Metasploit Framework
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
Metasploit framework
# Metasploit enumeration
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
Metasploit framework
### Phase 10: Metasploit SSH Modules
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
Metasploit framework
Use Metasploit for comprehensive SSH testing:
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
Metasploit framework
# Start Metasploit
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
Metasploit framework
| Metasploit | `use auxiliary/scanner/ssh/ssh_login` |
The skill requires and demonstrates Metasploit SSH scanner, login, public-key login, and enumeration modules. These are offensive exploitation-framework workflows.
Critical
System password file access
cat /etc/passwd | grep -v nologin
The command reads /etc/passwd during post-exploitation to enumerate usable local accounts. That supports follow-on access and lateral movement planning.
Critical
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The content combines credential brute forcing, private key access, tunneling, Metasploit modules, and remote command execution. That combination strongly matches offensive compromise workflows.
Critical
[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
This combination could indicate credential harvesting and exfiltration
The skill links network access with filesystem searches for SSH keys, authorized_keys, and shell history. That creates a clear credential harvesting and pivoting risk.
Critical
Credential Attack and Evasion Guidance
The skill provides SSH brute-force, password spraying, rate-limit evasion, and distributed attack advice that can enable unauthorized credential attacks.
The cited sections explicitly describe brute-force, password spraying, slow brute-force, and distributing attacks across IPs.
Critical
SSH Persistence Instructions
The post-exploitation section tells users to add their key to authorized_keys for persistence, creating ongoing access after compromise.
The heading states add persistence, and the command appends an SSH public key to authorized_keys.
Critical
Post-Compromise Credential Harvesting
The workflow searches for private keys, reads SSH trust files, and searches shell history for passwords after gaining SSH access.
The post-exploitation section directly includes key searches, authorized_keys access, and shell history searches for password strings.
High
SSH host/auth files
find / -name "authorized_keys" 2>/dev/null
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
High
SSH host/auth files
cat ~/.ssh/known_hosts
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
High
SSH host/auth files
cat ~/.ssh/authorized_keys
The command locates or reads SSH authorization and host trust files during post-exploitation. These files can reveal access paths and trusted hosts.
High
System reconnaissance
output, _ = execute_command(client, 'id; uname -a')
The Paramiko example runs id and uname after a successful brute-force login. That is remote post-compromise reconnaissance through an SSH session.
High
Network scanning tools
- Nmap with SSH scripts
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p 22 192.168.1.0/24 --open
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p 22,2222,22222,2200 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p- --open 192.168.1.100 | grep -i ssh
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -sV -p 22 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
# Nmap version detection with scripts
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -sV -p 22 --script ssh-hostkey 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p 22 --script ssh2-enum-algos 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.100
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
proxychains nmap -sT -Pn 192.168.1.0/24
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Network scanning tools
| `nmap --script ssh*` | SSH NSE scripts |
The skill requires or demonstrates Nmap SSH scanning, NSE scripts, and proxied scanning. These are active network reconnaissance steps with misuse potential.
High
Pivoting and Reverse Tunnel Guidance
The tunneling section includes reverse shell callback forwarding, SOCKS proxy setup, and proxychains scanning for internal network pivoting.
The cited lines explicitly mention a reverse shell callback, SOCKS proxy creation, and proxied Nmap scanning.
Capability review items (42)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hidden file in home directory
~/.ssh/id_rsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
~/.ssh/id_dsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
~/.ssh/id_ecdsa
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
~/.ssh/id_ed25519
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
ls -la ~/.ssh/
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
cat ~/.ssh/known_hosts
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
cat ~/.ssh/authorized_keys
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file in home directory
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The line references SSH private key or authorization files in a key discovery or post-exploitation context. These hidden files commonly contain credential material.
Critical
Hidden file access
~/.ssh/id_rsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
~/.ssh/id_dsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
~/.ssh/id_ecdsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
~/.ssh/id_ed25519
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
/root/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
/home/*/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
curl -s http://target.com/.ssh/id_rsa
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
ls -la ~/.ssh/
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
cat ~/.ssh/known_hosts
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
cat ~/.ssh/authorized_keys
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
Critical
Hidden file access
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
The access targets SSH private key paths, SSH directories, or authorized key files. In this context it supports credential harvesting or persistence.
High
sudo privilege escalation
# Check sudo privileges
This appears in the post-exploitation workflow and directs checking sudo privileges after SSH access. That supports privilege escalation assessment on a compromised host.
High
sudo privilege escalation
sudo -l
This appears in the post-exploitation workflow and directs checking sudo privileges after SSH access. That supports privilege escalation assessment on a compromised host.
High
Hardcoded URL
curl -s http://target.com/.ssh/id_rsa
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
High
Hardcoded URL
curl -s http://target.com/id_rsa
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
High
Hardcoded URL
curl -s http://target.com/backup/ssh_keys.tar.gz
The URL is a placeholder, but it is used to retrieve SSH private key material or key archives from a web target. That is credential exposure guidance, not a benign link.
High
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -L users.txt -p Password123 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -L users.txt -P passwords.txt ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -l admin -P passwords.txt -vV ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -l admin -P passwords.txt -f ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -L users.txt -p Summer2024! ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
hydra -L users.txt -p "$pass" ssh://192.168.1.100
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SSH protocol URL
| Hydra | `hydra -l user -P pass.txt ssh://host` |
The SSH URL appears in Hydra credential attack examples, including password spraying and exit-on-success behavior. This is actionable brute-force guidance.
High
SOCKS proxy
echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf
The proxychains SOCKS configuration is part of a pivoting workflow and is followed by proxied network scanning. This can bypass network segmentation during misuse.
High
Hidden file in home directory
cat ~/.bash_history | grep -i ssh
The workflow searches hidden shell history for SSH and password material after access. That is credential discovery from user files.
High
Hidden file in home directory
cat ~/.bash_history | grep -i pass
The workflow searches hidden shell history for SSH and password material after access. That is credential discovery from user files.
High
Hidden file access
cat ~/.bash_history | grep -i ssh
The command searches hidden shell history for SSH and password strings during post-exploitation. That is credential discovery behavior.
High
Hidden file access
cat ~/.bash_history | grep -i pass
The command searches hidden shell history for SSH and password strings during post-exploitation. That is credential discovery behavior.
High
Standard device file access
find / -name "id_rsa" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
High
Standard device file access
find / -name "id_dsa" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
High
Standard device file access
find / -name "authorized_keys" 2>/dev/null
The find command searches the whole filesystem for SSH private keys or authorization files after gaining access. That is credential discovery, even though the path pattern is generic.
Risk Factors
⚙️ External commands (46)
SKILL.md:43-55 SKILL.md:55-61 SKILL.md:61-80 SKILL.md:80-86 SKILL.md:86-97 SKILL.md:97-109 SKILL.md:109-130 SKILL.md:130-134 SKILL.md:134-146 SKILL.md:146-150 SKILL.md:150-158 SKILL.md:158-164 SKILL.md:164-178 SKILL.md:178-182 SKILL.md:182-196 SKILL.md:196-202 SKILL.md:202-223 SKILL.md:223-231 SKILL.md:231-243 SKILL.md:243-249 SKILL.md:249-258 SKILL.md:258-264 SKILL.md:264-274 SKILL.md:274-280 SKILL.md:280-293 SKILL.md:293-299 SKILL.md:299-326 SKILL.md:326-332 SKILL.md:332-386 SKILL.md:386-392 SKILL.md:392-424 SKILL.md:424-432 SKILL.md:432-433 SKILL.md:433-434 SKILL.md:434-435 SKILL.md:435-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-450 SKILL.md:450-451 SKILL.md:451-452 SKILL.md:452-477 SKILL.md:477-488 SKILL.md:300 SKILL.md:301
🌐 Network access (50)
SKILL.md:193 SKILL.md:194 SKILL.md:195 SKILL.md:236 SKILL.md:45 SKILL.md:48 SKILL.md:51 SKILL.md:54 SKILL.md:63 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:76 SKILL.md:79 SKILL.md:88 SKILL.md:91 SKILL.md:111 SKILL.md:114 SKILL.md:117 SKILL.md:120 SKILL.md:123 SKILL.md:126 SKILL.md:129 SKILL.md:136 SKILL.md:142 SKILL.md:145 SKILL.md:152 SKILL.md:156 SKILL.md:166 SKILL.md:169 SKILL.md:172 SKILL.md:176 SKILL.md:215 SKILL.md:220 SKILL.md:235 SKILL.md:239 SKILL.md:242 SKILL.md:253 SKILL.md:257 SKILL.md:266 SKILL.md:269 SKILL.md:270 SKILL.md:290 SKILL.md:292 SKILL.md:377 SKILL.md:398 SKILL.md:403 SKILL.md:411 SKILL.md:418 SKILL.md:111
📁 Filesystem access (28)
SKILL.md:184 SKILL.md:185 SKILL.md:186 SKILL.md:187 SKILL.md:288 SKILL.md:309 SKILL.md:310 SKILL.md:311 SKILL.md:314 SKILL.md:324 SKILL.md:325 SKILL.md:184 SKILL.md:185 SKILL.md:186 SKILL.md:187 SKILL.md:189 SKILL.md:190 SKILL.md:193 SKILL.md:288 SKILL.md:309 SKILL.md:310 SKILL.md:311 SKILL.md:314 SKILL.md:324 SKILL.md:325 SKILL.md:304 SKILL.md:305 SKILL.md:306
Detected Patterns
SSH directory access×11SSH private key file×12Metasploit framework×6System password file accessSystem reconnaissanceNetwork scanning tools×12[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-ssh-penetration-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-ssh-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-ssh-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-ssh-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). ssh-penetration-testing security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5BibTeX citation
@techreport{sickn33-sickn33-ssh-penetration-testing-2026,
author = {sickn33},
title = {ssh-penetration-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ssh-penetration-testing security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-ssh-penetration-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-ssh-penetration-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Prepare an SSH assessment plan
Create a scoped workflow for authorized SSH discovery, configuration review, and evidence collection.
Review infrastructure hardening
Identify OpenSSH configuration weaknesses, key exposure risks, and tunneling controls for owned systems.
Translate findings into remediation
Turn SSH test observations into clear report sections, priorities, and owner-ready action items.
Try These Prompts
Create an SSH audit checklist
Create a scoped SSH security checklist for an authorized assessment of [environment]. Include discovery, configuration review, key exposure checks, and reporting.
Review SSH configuration risks
Given these ssh-audit results: [paste results]. Summarize weak algorithms, authentication risks, and hardening actions.
Plan credential exposure testing
Plan a permissioned SSH credential exposure test for [scope]. Include rate limits, lockout safeguards, evidence handling, and stop conditions.
Build an SSH assessment report
Convert these SSH findings into an executive summary, technical findings, severity rationale, and remediation plan: [findings].
Best Practices
- Confirm written authorization, scope, timing, and stop conditions before using any assessment workflow.
- Use isolated lab targets for learning and production-like tests only with approval.
- Record evidence without storing private keys, passwords, or sensitive host data.
Avoid
- Running brute-force or scanning steps against systems outside the approved scope.
- Copying, storing, or reusing private keys found during an assessment.
- Using tunnels or persistence examples on production systems without explicit approval.
Frequently Asked Questions
Is this skill safe for beginners?
It is dual-use security content. Beginners should use lab systems and get guidance before live assessments.
Can it run tools for me?
No. It provides methodology and examples. The user controls any external tools.
Does it require authorization?
Yes. SSH testing must be limited to systems where written permission exists.
Can it help with defensive hardening?
Yes. It can organize SSH configuration review, weak algorithm identification, and remediation planning.
Does it include credential testing?
Yes. It discusses credential assessment methods, which require strict scope controls and lockout safeguards.
Can Claude, Codex, or Claude Code use it?
The metadata lists Claude, Codex, and Claude Code as supported tools.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/ssh-penetration-testingRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
10 downloads · 167 views
File structure
📄 SKILL.md