Inputting an SSH password using an expect script seems like an anti-pattern to me. In general, why can't you use a password-less key on the client and restrict what commands it can execute in the authorized_keys file on the server?