In that vein I think tmate should update their GitHub actions runner output line (for runner SSHing) to be an actual URL you can click on to save an annoying copy/paste/edit saga.
perhaps other browsers internalise this into a soft term in WebGL or something but I am content if I click one its normal SSH .ssh/config parsing and normal ssh-agent keys.
But now I wonder if there is some information leakage risk here. Aren't I going to reveal my key existences to <outside> from this? Feels like somebody can scrape my keyID and then track me in flow somehow unknown from this.
sadf://asdfsad
There might be some way this leaks ssh public key information (it's a normal ssh session afterall) - but you have to hit OK on the intent modal. My bet is there could be a vuln in the URL parsing of these scheme links. It's probably not so simple, but it screams: "Shell injection" when you can have a protocol link that ends up opening up a CLI app. But to be clear, I am in no way against the protocol links caps of browsers, especially SSH, I think it's super useful.
Most likely all such bugs would be found by now - but maybe something more complex, some specially crafted SSH url on some systems might be able to trigger something unintended (pun intented haha :))