ssh-llm-connectlisted

# ssh-llm-connect Safe SSH for LLM coding agents. ## When to use - Agent needs to read logs / ps / metrics / config on a remote host - Agent must NOT be able to mutate the remote (production guardrails) - User has run ./install.sh inside the project, so .claude/hooks/ssh-guard.sh and ssh/connect.sh exist ## What this skill does Always invoke via `./ssh/connect.sh <host-slug> "<command>"`. Never `ssh`/`scp`/ `sftp` directly — the PreToolUse hook will reject and surface why. If the command is refused by the read-only guard (Layer 3), do NOT add --allow-write or --shell. Those are bypass flags reserved for humans and the hook will reject them anyway. Instead, tell the user what was refused and ask them to run it manually if it really must mutate. ## Defense layers | Layer | Enforced by | Blocks | | ----- | ---------------------------- | --------------------------------------------------------- | | 1 | PreToolUse hook (harness) | direct ssh/scp/sftp, bypass flags | | 2 | permissions.deny in settings | bypass flags (belt + suspenders) | | 3 | connect.sh read-only guard | rm/sudo/redirect/systemctl write/curl POST/pkg install/-c | | 4 | server-side (user provides) | everything else | ## Read-only command rules (Layer 3, summary) Refused: sudo, su, rm, mv, cp, dd, mkfs, chmod, chown, kill, reboot, passwd, useradd, mount, iptables, crontab, tee, wget, scp, rsync, eval, exec, source, `>`, `>>`, `sed -i`, systemctl write subcommands, git p