wish-ssh-code-review

What This Skill Does

The wish-ssh-code-review skill acts as a specialized static analysis assistant for developers building SSH servers using the Go charmbracelet/wish library. It provides a structured evaluation framework that verifies security, middleware configuration, session management, and graceful shutdown procedures in your SSH server implementations. By leveraging a comprehensive checklist and predefined patterns, the skill helps you catch common pitfalls like improper middleware ordering, memory leaks during connection handling, and insecure host key management.

Installation

To integrate this skill into your environment, run the following command in your terminal: clawhub install openclaw/skills/skills/anderskev/wish-ssh-code-review Ensure you have the OpenClaw agent initialized in your project root to allow the skill to inspect your codebase effectively.

Use Cases

This skill is ideal for:

• Auditing new SSH server implementations for security vulnerabilities before deployment.
• Refactoring existing Wish-based services to incorporate graceful shutdowns and better resource management.
• Debugging middleware conflicts in complex SSH pipelines where logging or authentication might be failing.
• Standardizing terminal-based applications (BubbleTea) by ensuring correct PTY handling and window resizing logic.
• Transitioning from prototyping code to production-ready deployments by verifying connection timeouts and resource limiting settings.

Example Prompts

1. "Review my main.go file. I am using charmbracelet/wish and want to ensure my middleware chain handles authentication before session initiation."
2. "Please check my SSH server implementation for graceful shutdown patterns; I suspect my active sessions are being dropped abruptly when the service restarts."
3. "Analyze this snippet for my BubbleTea TUI. Are my PTY window dimensions being passed to the model correctly for responsive terminal layouts?"

Tips & Limitations

To get the most value, ensure your source code is well-structured and provided within the context of the agent. The skill functions best when provided with the complete initialization block of the server. Note that while this skill can identify common security patterns, it is a static analyzer. It cannot guarantee runtime security against zero-day exploits in dependencies. Always pair the output of this skill with automated vulnerability scanning tools and thorough unit testing of your authentication logic. If the code is highly modular, consider pointing the agent to the specific package directory where server initialization occurs for more accurate results.