systemd user units to wipe sensitive SSH keys from the SSH agent every night

wipe-ssh-agent.service

[Unit]
Description=Wipe sensitive SSH keys from the SSH agent

[Service]
Type=oneshot
ExecStart=/usr/bin/ssh-add -d ${HOME}/.ssh/KEY-NAME-1 ${HOME}/.ssh/KEY-NAME-2 …
# don’t fail if the key wasn’t in the SSH agent in the first place
SuccessExitStatus=1

wipe-ssh-agent.timer

[Unit]
Description=Wipe sensitive SSH keys from the SSH agent every night

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Usage: adjust the ExecStart= line in wipe-ssh-agent.service to list the key(s) you want to wipe, then copy both files into ~/.config/systemd/user/ and run systemctl --user daemon-reload and systemctl --user enable --now wipe-ssh-agent.timer.

This assumes that your user manager has the SSH_AUTH_SOCK environment variable needed to talk to the SSH agent.

Also, consider adding aliases like the following to your .bashrc:

alias npm='systemctl --user start wipe-ssh-agent && npm'
alias grunt='systemctl --user start wipe-ssh-agent && grunt'
alias composer='systemctl --user start wipe-ssh-agent && composer'
# ...

Or use a more sophisticated solution to protect your system from rogue npm packages and similar issues, such as fresh.