How do I install the Ssh Keychain Access skill?

Run npx skillmds@latest add tomevault-io/ssh-keychain-access in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ssh Keychain Access safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ssh Keychain Access?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ssh Keychain Access free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ssh Keychain Access?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ssh Keychain Access by tomevault-io

Name: Ssh Keychain Access
Author: tomevault-io

Ssh Keychain Access

Use when helping establish SSH access through macOS Keychain credentials, especially emergency root SSH, password-to-key bootstrap, authorized_keys repair, or adding SSH private keys to the Apple keychain.

tomevault-io 1b92b26 2 files · 4.0 KB Updated Sep 17, 2026

File contents

SSH Keychain Access

Use this skill for SSH access recovery where credentials are in macOS Keychain.

Security stance

Prefer SSH keys loaded with ssh-add --apple-use-keychain.
Use a Keychain-stored password only as an emergency fallback or to bootstrap key-based access.
Never print passwords, private keys, API keys, WHM credentials, or licence credentials.
Do not run security find-generic-password -w ... as a standalone command that would expose the password in tool output.
Do not use sshpass -p, put passwords in command history, or disable host key checking.
For root SSH, narrow the target to the specific host/IP and remove temporary access when recovery is complete.

Key-first workflow

Check loaded identities:
```
ssh-add -l
```

Add the private key to the macOS keychain:

chmod 600 /path/to/private_key
ssh-add --apple-use-keychain /path/to/private_key

Test SSH with public-key auth:

ssh -o PreferredAuthentications=publickey user@host

Store a password in Keychain

Run this only in the user's local terminal. It avoids placing the password in shell history:

SERVICE="tde-root-102.211.28.132"
ACCOUNT="root@102.211.28.132"
printf 'Password for %s: ' "$ACCOUNT"
OLD_STTY=$(stty -g)
trap 'stty "$OLD_STTY"; unset SSH_PASSWORD' INT TERM EXIT
stty -echo
IFS= read -r SSH_PASSWORD
stty "$OLD_STTY"
printf '\n'
security add-generic-password -U -a "$ACCOUNT" -s "$SERVICE" -w "$SSH_PASSWORD"
unset SSH_PASSWORD
trap - INT TERM EXIT

Verify the item exists without printing the password:

security find-generic-password -a "$ACCOUNT" -s "$SERVICE"

Use the helper

Use the bundled helper when password SSH is required and the password must come from Keychain without appearing in output:

shared/skills/ssh-keychain-access/scripts/ssh-keychain-login.sh \
  --host 102.211.28.132 \
  --user root \
  --service tde-root-102.211.28.132 \
  --account root@102.211.28.132

For an unknown host key, verify the expected server host key out of band first. Only then re-run with:

--accept-new-host-key

To run a one-off remote command, append it after --:

shared/skills/ssh-keychain-access/scripts/ssh-keychain-login.sh \
  --host 102.211.28.132 \
  --user root \
  --service tde-root-102.211.28.132 \
  --account root@102.211.28.132 \
  -- 'hostname; whoami'

Bootstrap public-key access

If password access works, use it only long enough to install a public key:

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d) -C "codex-whm-recovery-$(date +%Y-%m-%d)"
ssh-add --apple-use-keychain ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d)
cat ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d).pub

Then append only the public key to the server's authorized_keys, confirm public-key login works, and prefer key login for the rest of the session.

Source: RichardGeorgeDavis/Codex-Workspace — distributed by TomeVault.

---name: ssh-keychain-accessdescription: Use when helping establish SSH access through macOS Keychain credentials, especially emergency root SSH, password-to-key bootstrap, authorized_keys repair, or adding SSH private keys to the Apple keychain.---# SSH Keychain AccessUse this skill for SSH access recovery where credentials are in macOS Keychain.## Security stance- Prefer SSH keys loaded with `ssh-add --apple-use-keychain`.- Use a Keychain-stored password only as an emergency fallback or to bootstrap key-based access.- Never print passwords, private keys, API keys, WHM credentials, or licence credentials.- Do not run `security find-generic-password -w ...` as a standalone command that would expose the password in tool output.- Do not use `sshpass -p`, put passwords in command history, or disable host key checking.- For root SSH, narrow the target to the specific host/IP and remove temporary access when recovery is complete.## Key-first workflow1. Check loaded identities: ```bash ssh-add -l ```2. Add the private key to the macOS keychain: ```bash chmod 600 /path/to/private_key ssh-add --apple-use-keychain /path/to/private_key ```3. Test SSH with public-key auth: ```bash ssh -o PreferredAuthentications=publickey user@host ```## Store a password in KeychainRun this only in the user's local terminal. It avoids placing the password in shell history:```bashSERVICE="tde-root-102.211.28.132"ACCOUNT="root@102.211.28.132"printf 'Password for %s: ' "$ACCOUNT"OLD_STTY=$(stty -g)trap 'stty "$OLD_STTY"; unset SSH_PASSWORD' INT TERM EXITstty -echoIFS= read -r SSH_PASSWORDstty "$OLD_STTY"printf '\n'security add-generic-password -U -a "$ACCOUNT" -s "$SERVICE" -w "$SSH_PASSWORD"unset SSH_PASSWORDtrap - INT TERM EXIT```Verify the item exists without printing the password:```bashsecurity find-generic-password -a "$ACCOUNT" -s "$SERVICE"```## Use the helperUse the bundled helper when password SSH is required and the password must come from Keychain without appearing in output:```bashshared/skills/ssh-keychain-access/scripts/ssh-keychain-login.sh \ --host 102.211.28.132 \ --user root \ --service tde-root-102.211.28.132 \ --account root@102.211.28.132```For an unknown host key, verify the expected server host key out of band first. Only then re-run with:```bash--accept-new-host-key```To run a one-off remote command, append it after `--`:```bashshared/skills/ssh-keychain-access/scripts/ssh-keychain-login.sh \ --host 102.211.28.132 \ --user root \ --service tde-root-102.211.28.132 \ --account root@102.211.28.132 \ -- 'hostname; whoami'```## Bootstrap public-key accessIf password access works, use it only long enough to install a public key:```bashssh-keygen -t ed25519 -a 100 -f ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d) -C "codex-whm-recovery-$(date +%Y-%m-%d)"ssh-add --apple-use-keychain ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d)cat ~/.ssh/codex-whm-recovery-$(date +%Y-%m-%d).pub```Then append only the public key to the server's `authorized_keys`, confirm public-key login works, and prefer key login for the rest of the session.---> Source: [RichardGeorgeDavis/Codex-Workspace](https://github.com/RichardGeorgeDavis/Codex-Workspace) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions