ssh-remote-operations

星标8

分支0

更新时间2026年7月9日 11:09

Run DevOps remote operations through project-root SSH configuration. Use when DevOps must execute commands, install software or packages, inspect a remote host, stage release artifacts, or prepare a non-local server through `.ssh/config` without exposing private keys, SSH config contents, passwords, or environment secrets to the model.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

evolplus

evolplus/talos

打开 GitHub 仓库查看创作者相关仓库

下载

SSH Remote Operations

When to use

Use this skill when a DevOps task targets a remote VM or bare server and the project provides SSH connection configuration under project-root .ssh/. The SSH files are operator-owned credential material: DevOps may reference them in commands, but must not read, summarize, copy, or print their contents.

Inputs and outputs

Inputs: task ID, target environment, approved SSH host alias, project-root .ssh/config, architecture/deploy docs, package/software requirements, and any human approval required for non-dev environments.
Outputs: remote preflight evidence, command/package-change summary, health-check evidence, rollback notes, and docs/deploy-reports/<task-id>.md or docs/devops/<task-id>/ artifacts with secrets redacted.

Procedure

Resolve the target host alias. Use only a named host alias from project-root .ssh/config. Do not read .ssh/config; ask the operator for the alias if the task does not name it. Use ssh -F .ssh/config <alias> <command> for remote execution.
Gate the target environment. Local/dev/test servers may proceed when the task explicitly names the target. Staging requires task approval evidence. Production requires a human-approved change record, a dry-run or written execution plan, and rollback instructions before any mutation.
Run a safe preflight. Verify connectivity with a non-secret command such as ssh -F .ssh/config <alias> 'printf "%s\n" ok; uname -s; uname -m; id -un'. Do not run env, printenv, set, cat ~/.ssh/*, or commands that dump service credentials.
Detect the remote OS before installing packages. Read non-secret OS metadata (/etc/os-release, uname) and choose the native package manager. Use non-interactive flags and exact package names from the task or architecture docs. If sudo prompts for a password, stop with NEEDS_CONTEXT; never ask the model to handle passwords.
Install only declared software. Package installation is allowed only when the task explicitly requires it. Record package names and versions in the report. Do not run broad upgrades (apt upgrade, yum update, brew upgrade) unless the task is specifically an OS maintenance task with approval.
Stage artifacts without copying secrets. Use scp -F .ssh/config or rsync -e 'ssh -F .ssh/config' only for build artifacts, compose files, manifests, or generated release bundles. Never copy .env*, .ssh/, .k8s/ kubeconfigs, private keys, registry credentials, or raw secret manifests.
Make commands reproducible. Prefer checked-in scripts or task-scoped scripts under docs/devops/<task-id>/ for multi-step remote work. Remote one-liners should use set -euo pipefail when run through bash -lc.
Capture redacted evidence. Store command summaries, package changes, remote host alias, target environment, health-check URLs, and rollback commands. Do not store host private IPs, usernames, tokens, key paths beyond the alias/config path, or raw command output that contains secrets.

Hard rules

Never read or print project-root .ssh/ files, private keys, ~/.ssh/, passwords, agent sockets, or known-host material.
Never run remote secret-dumping commands (env, printenv, set, cat ~/.ssh/*, cat .env*, kubectl config view --raw) through SSH.
Never install packages on staging or production without explicit task approval and rollback notes.
Never pipe unaudited network downloads into a shell on the remote host.
Never put credentials, SSH config contents, private hostnames, or secret environment values into deploy reports.

References

../docker-deployment/SKILL.md - combine with SSH for remote Docker or Compose deployment.
../kubernetes-deployment/SKILL.md - use kubeconfig by reference only; do not read credentials.
../../hooks/privacy-check.cjs - runtime credential-path guard.

同仓库更多 Skills

同仓库

be-framework-coding-standard

evolplus/talos

Standardized backend implementation guidance for BE Dev using the SRS-declared Backend-Track and Backend-Framework. Use when coding, refactoring, or reviewing backend web APIs, BFFs, microservices, workers, jobs, or service integrations in TypeScript with Express, TypeScript with NestJS, Python with FastAPI, Java with Spring Boot, .NET Core C#, Pure Golang, Java Core, Golang with Gin, Golang with Fiber, Golang with Echo, or Golang with Kratos; BE Dev reads docs/SRS.md Backend-Track and Backend-Framework plus §3.4.5 Source Layout, then selects the matching reference so routing, layering, contracts, validation, observability, errors, transactions, and tests match the chosen stack.

2026-07-308

local-deployment

evolplus/talos

How DevOps composes the local Docker environment for QA and operator trials, including port probing, secret-safe env discovery, test-only runtime-reset endpoint verification for direct-DB fixtures, QA deploy-report fields, and human trial URLs without editing project Compose files.

2026-07-308

playwright-author

evolplus/talos

Concrete how-to for QA-Author writing Playwright specs from markdown TCs — project layout, full-state resets for direct-DB fixtures and caches, parallel-worker isolation, contract-aware URL assertions, network mocking, retries, traces, and visual diffs. Consult after `ui-test-execution` when the target surface is web AND the project uses Playwright.

2026-07-308

qa-execution-runner

evolplus/talos

QA-Exec run contract for executing authored test cases against the deployed build. Use when QA-Exec is dispatched for a task in-test to gather by-us/by-task test cases, check executable specs and instrumentation coverage, invoke the proper runner, execute UI tiers, validate visual specs, route failures, and write docs/qa-reports/<task-id>.md plus artifacts.

2026-07-308

sdlc-loop

evolplus/talos

Codex-native orchestration entrypoint for Evo Talos. Use when the user asks for /sdlc-loop, sdlc-loop, start project, continue the SDLC loop, run the governed workflow, or auto-dispatch eligible SDLC work until the next gate. Acts as the Codex equivalent of the Claude slash command.

2026-07-308

ui-test-execution

evolplus/talos

Framework-agnostic principles for executing UI tests against the running build — TC-to-spec mapping, selectors, full-state fixture reset across DB/cache/worker state, shared-resource parallelism, determinism, and visual diffs. Consult when QA-Author writes executable specs or QA-Exec invokes a runner against a deployed build.

2026-07-308

name	ssh-remote-operations
description	Run DevOps remote operations through project-root SSH configuration. Use when DevOps must execute commands, install software or packages, inspect a remote host, stage release artifacts, or prepare a non-local server through `.ssh/config` without exposing private keys, SSH config contents, passwords, or environment secrets to the model.
agents	["devops"]
sdlc_phase	deploy
owner	Platform Eng
status	active

SSH Remote Operations

When to use

Inputs and outputs

Inputs: task ID, target environment, approved SSH host alias, project-root .ssh/config, architecture/deploy docs, package/software requirements, and any human approval required for non-dev environments.
Outputs: remote preflight evidence, command/package-change summary, health-check evidence, rollback notes, and docs/deploy-reports/<task-id>.md or docs/devops/<task-id>/ artifacts with secrets redacted.

Procedure

Resolve the target host alias. Use only a named host alias from project-root .ssh/config. Do not read .ssh/config; ask the operator for the alias if the task does not name it. Use ssh -F .ssh/config <alias> <command> for remote execution.
Gate the target environment. Local/dev/test servers may proceed when the task explicitly names the target. Staging requires task approval evidence. Production requires a human-approved change record, a dry-run or written execution plan, and rollback instructions before any mutation.
Run a safe preflight. Verify connectivity with a non-secret command such as ssh -F .ssh/config <alias> 'printf "%s\n" ok; uname -s; uname -m; id -un'. Do not run env, printenv, set, cat ~/.ssh/*, or commands that dump service credentials.
Detect the remote OS before installing packages. Read non-secret OS metadata (/etc/os-release, uname) and choose the native package manager. Use non-interactive flags and exact package names from the task or architecture docs. If sudo prompts for a password, stop with NEEDS_CONTEXT; never ask the model to handle passwords.
Install only declared software. Package installation is allowed only when the task explicitly requires it. Record package names and versions in the report. Do not run broad upgrades (apt upgrade, yum update, brew upgrade) unless the task is specifically an OS maintenance task with approval.
Stage artifacts without copying secrets. Use scp -F .ssh/config or rsync -e 'ssh -F .ssh/config' only for build artifacts, compose files, manifests, or generated release bundles. Never copy .env*, .ssh/, .k8s/ kubeconfigs, private keys, registry credentials, or raw secret manifests.
Make commands reproducible. Prefer checked-in scripts or task-scoped scripts under docs/devops/<task-id>/ for multi-step remote work. Remote one-liners should use set -euo pipefail when run through bash -lc.
Capture redacted evidence. Store command summaries, package changes, remote host alias, target environment, health-check URLs, and rollback commands. Do not store host private IPs, usernames, tokens, key paths beyond the alias/config path, or raw command output that contains secrets.

Hard rules

Never read or print project-root .ssh/ files, private keys, ~/.ssh/, passwords, agent sockets, or known-host material.
Never run remote secret-dumping commands (env, printenv, set, cat ~/.ssh/*, cat .env*, kubectl config view --raw) through SSH.
Never install packages on staging or production without explicit task approval and rollback notes.
Never pipe unaudited network downloads into a shell on the remote host.
Never put credentials, SSH config contents, private hostnames, or secret environment values into deploy reports.

References

../docker-deployment/SKILL.md - combine with SSH for remote Docker or Compose deployment.
../kubernetes-deployment/SKILL.md - use kubeconfig by reference only; do not read credentials.
../../hooks/privacy-check.cjs - runtime credential-path guard.