ssh-keychain-unlock — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ssh-keychain-unlock (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Claude Code stores credentials in the macOS Keychain (Claude Code-credentials service). When accessing a Mac via SSH (no GUI session), the login keychain is locked, causing Claude Code to appear unauthenticated.
security show-keychain-info ~/Library/Keychains/login.keychain-db shows the keychain is lockedAdd to ~/.zshrc:
# Unlock macOS keychain for SSH sessions (needed for Claude Code auth)
if [[ -n "$SSH_CONNECTION" ]]; then
security unlock-keychain ~/Library/Keychains/login.keychain-db 2>/dev/null
fiPrompts for macOS login password each SSH session. Simple but requires manual input.
For fully headless operation with no password prompt:
1. Create password file (~/.claude/.keychain-password, permissions 600):
echo 'YOUR_MACOS_PASSWORD' > ~/.claude/.keychain-password
chmod 600 ~/.claude/.keychain-password2. Create unlock script (~/.claude/unlock-keychain.sh, permissions 700):
cat > ~/.claude/unlock-keychain.sh << 'SCRIPT'
#!/bin/bash
security unlock-keychain -p "$(cat ~/.claude/.keychain-password)" ~/Library/Keychains/login.keychain-db
SCRIPT
chmod 700 ~/.claude/unlock-keychain.sh3. Create LaunchAgent (~/Library/LaunchAgents/com.claude.unlock-keychain.plist):
cat > ~/Library/LaunchAgents/com.claude.unlock-keychain.plist << 'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.claude.unlock-keychain</string>
<key>ProgramArguments</key>
<array>
<string>/bin/bash</string>
<string>__HOME__/.claude/unlock-keychain.sh</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
PLIST
# Fix path
sed -i '' "s|__HOME__|$HOME|g" ~/Library/LaunchAgents/com.claude.unlock-keychain.plist4. Load the agent:
launchctl load ~/Library/LaunchAgents/com.claude.unlock-keychain.plist| Command | Purpose |
|---|---|
security show-keychain-info ~/Library/Keychains/login.keychain-db | Check keychain lock status |
security unlock-keychain ~/Library/Keychains/login.keychain-db | Manually unlock (interactive) |
bash ~/.claude/unlock-keychain.sh | Test auto-unlock script |
launchctl load ~/Library/LaunchAgents/com.claude.unlock-keychain.plist | Load LaunchAgent |
launchctl unload ~/Library/LaunchAgents/com.claude.unlock-keychain.plist | Unload LaunchAgent |
600 (owner-only). Others can read your macOS password otherwise.launchctl load to activate it.~/.claude/.keychain-password too.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.