ClawHub
Back to skill

Security audit

Hetzner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Hetzner operations guide that stores local infrastructure notes and avoids saving secrets.

Before installing, be comfortable with the skill keeping local notes about your Hetzner projects, servers, domains, mail setup, costs, incidents, and runbooks. Keep ~/Clawic/data access-controlled and do not sync or commit it casually; credentials should remain in a keychain, password manager, CI secret store, or other pointer location, not in the notes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
87% confidence
Finding
The file instructs operators to persist mail-operational details such as relay usage, rDNS mappings, domain mail state, and mail setup artifacts in notes under the home directory. While it avoids storing raw secrets in some places, these notes can still aggregate sensitive configuration and infrastructure metadata that materially helps an attacker enumerate mail paths, target DNS/mail controls, or abuse access if the notes are readable, synced, or committed without protection.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
memory-template.md:60