We ship it and use it in Fedora and RHEL. It is here for a long time and it is using the code from openssh for almost all the public key operations (and openssh is using openssl). The code is quite fair.
pam_ssh_agent_auth itself basically does only verification that the public key matches and that the signature provided by
ssh-agent is valid. All the private key operations are still left on your
It is not clear what is going to be your exact use case from this question, but from my POV, the most powerful thing on this is having single agent on local machine to log in to all the servers and allowing
sudo operations there (or use separate key for this module). It exposes a bit "single point of failure" (if you lose the unencrypted key, it would be a problem, but this module does not expose it).
You should probably disable ssh-agent forwarding for untrusted hosts (or by default and whitelist your trusted), maybe also add the key with
-c switch to confirm PK actions or some timeout (
-t to let it expire).