Security: Detect SSH remote command execution

## Bypass Description

SSH can execute commands on remote hosts:

```bash
ssh localhost npm install malicious
ssh host "npm install evil"
```

## Difficulty: Medium

Parse SSH arguments to extract remote command.

## Priority: Low

Unusual attack vector.

---
Found in security audit 2024-01-06