no, this is wrong. They should not be using SSH for the upstream repo as they don't have write access to it.
Either use https or git