# Vps Ssh

> Safely inspect, maintain, or deploy to a VPS that the user has already configured in local SSH settings. Use for an explicit VPS task or $vps-ssh; do not use for unrelated local work, unauthorised hosts, password collection, or destructive remote changes without confirmation.

- Skill: `liuyike200811-maker/vps-ssh` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add liuyike200811-maker/vps-ssh`
- Raw SKILL.md: https://api.skillmd.com/api/skills/liuyike200811-maker/vps-ssh/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: liuyike200811-maker (https://skillmd.com/u/liuyike200811-maker)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/liuyike200811-maker/vps-ssh

---


# VPS SSH

## Use When

- The user explicitly asks to inspect, maintain, troubleshoot, or deploy to a VPS they have already configured for SSH.
- The user invokes `$vps-ssh` and specifies a VPS task, or needs help identifying why their local SSH alias does not resolve.

## Don't Use When

- The task is unrelated local work or the user has not authorized access to the target host.
- The only available path is password authentication, a guessed IP address, a copied private key, or disabled host-key verification.
- The requested action is destructive, persistent, or disruptive and the user has not explicitly approved it.

## Workflow

1. Ask for the concrete remote task if one was not provided. Use the user-configured SSH host alias rather than an IP address or a copied key path.
2. Start with a noninteractive, read-only connection check:

   ```powershell
   ssh -o BatchMode=yes <ssh-host-alias> "hostname; id; uptime; df -h /"
   ```

3. If alias resolution fails, inspect only whether the local SSH configuration is readable and contains the requested alias. Do not print the full configuration, private-key paths, key material, hostnames, usernames, or passwords.
4. Perform the user’s requested read-only inspection or narrowly scoped change. Verify the relevant service, command result, or endpoint after a change.

## Rules

- Use `BatchMode=yes` so automation never hangs at a password prompt.
- Never request, store, print, upload, replace, or expose passwords, private keys, personal host aliases, or complete SSH configuration.
- Never guess an IP address, choose another identity file, disable host-key verification, switch to password authentication, or rewrite SSH configuration without explicit approval.
- Connection access does not itself authorize a change. Before an unrequested deletion, package install, firewall/authentication change, production configuration edit, or service restart, state the target and impact and obtain confirmation.
- Prefer narrow, reversible changes and verify results rather than reporting only that a command ran.

## Examples

```powershell
ssh -o BatchMode=yes production-vps "systemctl status nginx --no-pager"
ssh -o BatchMode=yes production-vps "journalctl -u nginx -n 100 --no-pager"
```

## Edge Cases

- A sandboxed runner may be unable to read the user’s SSH configuration even when it is valid. Report the result as inconclusive and request permission for a bounded local configuration check.
- If public-key authentication fails, show the non-sensitive SSH error and stop; do not downgrade to passwords or bypass host verification.
- If the requested operation is disruptive, wait for explicit confirmation after describing the exact host, service, and impact.

## References

- [OpenSSH client documentation](https://man.openbsd.org/ssh)
- [OpenSSH configuration documentation](https://man.openbsd.org/ssh_config)