| name | runpod-ssh-safety |
| description | Use when the user mentions RunPod, ssh.runpod.io, or any flow that pushes secrets through a RunPod ssh session. Covers the PTY-echo failure mode and the 2026-04-29 HF_TOKEN leak. Not applicable to Brev or direct-ssh hosts — medomni's serving GPU is Brev, so this is medomni-rare and lives here rather than in CLAUDE.md §0. |
RunPod ssh safety
When this applies
Only when the operation actually touches RunPod's ssh proxy
(ssh.runpod.io). medomni's serving GPU is the Brev pod
exact-kind-orca, which uses direct ssh with no PTY-echo issue (see
memory brev_ssh_direct_access.md). So in the typical medomni session
none of this applies — that is exactly why it lives in a load-on-demand
skill rather than CLAUDE.md §0.
The failure mode
The RunPod proxy at ssh.runpod.io requires PTY allocation for command
execution. PTYs echo stdin to stdout by default — server-side behavior
that cannot be disabled from the client. Any secret pushed via:
- heredoc (
<< EOF with a secret inside)
- base64-encoded stdin pipe
- inline-env (
KEY=value ssh ...)
- stdin redirect (
< secrets-file)
…through this proxy is mirrored to the conversation transcript and to
Claude Code task-output JSONL files at
/private/tmp/claude-*/tasks/<task-id>.output. Those files persist
across sessions.
2026-04-29 incident
During a Phase 2.2 build accessed through the RunPod proxy, an HF_TOKEN
was pushed in base64-heredoc form. The token surfaced verbatim in the
task-output file. Rotated within minutes per the prism42 2026-04-27
precedent.
Durable mitigations
scripts/_runpod_ssh.sh carries a hard secret-grep guard: regex
blocklist on HF_TOKEN, hf_*, nvapi-*, sk-*, sk-ant-*,
xai-*, AIza*, ghp_*, ghs_*, plus generic
(API_KEY|SECRET|PASSWORD|TOKEN)= patterns. The script refuses to
forward when matched.- Provision secrets via the RunPod console's Pod Environment
Variables UI, or via the user's own interactive ssh session (separate
from any Claude-driven shell).
- Never read
.env values into a shell variable that gets
interpolated into a _runpod_ssh.sh command body. Use
awk -F= '/^KEY=/ {print $2}' .env and pipe to a file, not to a
variable.
- The guard's bypass env var
(
RUNPOD_SSH_ALLOW_SECRET_GREP_BYPASS=1) exists for false-positive
recovery only. Never use it to push a real secret.
Related memory
feedback_runpod_proxy_pty_echo.md (the general lesson)feedback_no_secret_value_dumps.md (related systemctl show and
ps -ef | grep docker failure modes)brev_ssh_direct_access.md (why this skill is medomni-rare —
the production GPU uses Brev, not RunPod)
