Operating tailscale agent hosts
Portable Agent Skills for coding agents, including Svelte/SvelteKit and workflow tooling skills.
npx -y skills add spences10/skills --skill operating-tailscale-agent-hostsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 13 stars13 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Private remote coding-agent hosts over Tailscale. Use when configuring unattended Linux workers, persistent remote agents, or private access to development services.
SKILL.md
2.0 KB, as published. Nobody here has run it
Operating Tailscale Agent Hosts
Turn an existing Linux machine into a private, persistent coding-agent worker without exposing SSH or development ports to the public internet.
Core Rules
- Treat Tailscale as the private network path; still configure a service to accept SSH, desktop, or HTTP traffic.
- Prefer Tailscale SSH and narrowly scoped access rules over public SSH or router port forwarding.
- Keep privileged operations and OAuth approval user-driven; never request passwords or expose tokens in logs.
- Verify unattended boot instead of assuming it: networking, Tailscale, sleep policy, encrypted-disk prompts, and services are separate concerns.
- Use tmux for persistence and git worktrees for concurrent mutating agents.
- Bind dev servers to localhost and expose them with Tailscale Serve when possible.
- Transfer configuration selectively; exclude credentials, histories, caches, databases, host keys, and machine-specific trust records by default.
Workflow
- Run
scripts/readiness-check.shon the proposed host. - Follow setup.md to establish unattended private access.
- Follow agent-operations.md for tmux, worktrees, authentication, and delivery.
- Use troubleshooting.md when access only works after login, OAuth fails, or remote services are unreachable.
Security Boundary
Disabling Tailscale SSH check mode removes periodic browser re-authentication; it does not remove tailnet identity or encryption. Only use an accept rule when source identity, destination device, and destination user are narrowly restricted. Never broaden the default self/root rule merely for convenience.