Hetzner Cloud CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:06 PM UTC
• Version: 1.0.0

Overview

This is a coherent Hetzner Cloud helper, but it includes under-scoped high-impact cloud operations and a risky system-wide CLI install path.

Install only if you are comfortable giving an agent effective Hetzner Cloud administration authority. Prefer installing hcloud yourself from a pinned, verified release in a user-owned path, use least-privilege or project-scoped tokens, avoid broad public SSH rules, and require explicit approval before stop/delete/remote-shell actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Unverified Mutable Binary Download and System-Wide Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-27
Vulnerability Type: Remote retrieval and execution of an unverified executable
Risk Level: High

bash

# Detect architecture
ARCH=$(uname -m)
if [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then
  URL="https://github.com/hetznercloud/cli/releases/latest/download/hcloud-linux-arm64.tar.gz"
else
  URL="https://github.com/hetznercloud/cli/releases/latest/download/hcloud-linux-amd64.tar.gz"
fi

# Install
cd /tmp
wget -q "$URL"
tar xzf hcloud-linux-*.tar.gz
sudo mv hcloud /usr/local/bin/
chmod +x /usr/local/bin/hcloud

Technical Analysis

The installation procedure downloads an executable archive from an external URL and installs its contents into the system-wide executable directory. Although the URL points to the official hetznercloud/cli GitHub repository over HTTPS rather than a personal pastebin, the procedure uses the mutable latest release reference and performs no checksum or cryptographic-signature verification.

Consequently, the executable that is installed can change after the Skill has been reviewed. Compromise of the upstream release process, repository, release asset, or delivery infrastructure could cause different code to be installed without any corresponding change to this Skill.

The procedure also operates directly in the shared /tmp directory and extracts hcloud-linux-*.tar.gz using a wildcard rather than an exact downloaded filename. A local attacker able to create files in /tmp may attempt to influence which archives are processed or exploit pre-existing files and archive contents. No private temporary directory, archive-content validation, or cleanup is used.

Finally, sudo mv places the unverified executable in /usr/local/bin, which crosses a system-wide privilege boundary. A root-level installation is not the minimum privilege necessary to run the CLI because it could instead be installed int ...[truncated 2328 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an explicit, reviewed CLI version instead of using the mutable latest URL.
2. Obtain the expected SHA-256 digest from a trusted, version-specific source and verify it before extraction. Prefer verification of a vendor-provided cryptographic signature where available.
3. Abort installation if integrity or signature verification fails.
4. Create a private temporary directory with mktemp -d, set restrictive permissions, and remove it with a shell trap after installation.
5. Download to an exact filename and extract that filename explicitly; do not use hcloud-linux-*.tar.gz.
6. Inspect or constrain archive paths before extraction to prevent absolute-path or path-traversal entries.
7. Prefer installation into a user-owned directory such as ~/.local/bin so that sudo is unnecessary.
8. If a system-wide installation is explicitly required, verify the artifact first and use sudo install -m 0755 only for the final, validated executable.
9. Reject unsupported architectures explicitly rather than treating every non-ARM architecture as AMD64.
10. Document the exact source, version, expected digest, and trust assumptions so future reviewers can reproduce provenance verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

# Add SSH key
hcloud ssh-key create \
  --name my-key \
  --public-key-from-file ~/.ssh/id_ed25519.pub

# Delete SSH key
hcloud ssh-key delete <name-or-id>

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes local installation steps that download a binary from the internet and place it into /usr/local/bin with elevated privileges. Even if the tool is legitimate, bundling software installation expands the skill's authority from cloud management into host modification and supply-chain exposure, which is risky in an agent context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The installation flow uses sudo to move a downloaded binary into a privileged system path, which requires elevated host access and can persist untrusted code system-wide. In an agent skill, normalizing privileged installation increases the blast radius of misuse or supply-chain compromise.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

cd /tmp wget -q "$URL" tar xzf hcloud-linux-*.tar.gz sudo mv hcloud /usr/local/bin/ chmod +x /usr/local/bin/hcloud

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration instructions tell the user to place a live Hetzner API token into a plaintext config file without emphasizing secret-handling risks. This can lead to credential leakage through shell history, copied docs, backups, or accidental commits, enabling full cloud account compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs persistent storage of an API token in ~/.config/hcloud/cli.toml, establishing long-lived authenticated access on the host. While common for CLIs, in an agent environment this creates durable credentials that may outlast the task and be accessible to other processes or future runs.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Configuration (first time):

bash

mkdir -p ~/.config/hcloud
cat > ~/.config/hcloud/cli.toml <<EOF
active_context = "default"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

name = "default" token = "YOUR_HETZNER_API_TOKEN" EOF chmod 600 ~/.config/hcloud/cli.toml

text

**Verify**:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents destructive server lifecycle actions such as stop and delete without warnings, confirmations, or guidance about production impact. In agent use, this increases the chance of accidental downtime or irreversible deletion from normal-looking examples.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Documenting hcloud server ssh and especially running arbitrary remote shell commands gives the skill a general-purpose remote execution capability beyond narrowly scoped infrastructure CRUD operations. In an agent workflow, this could be used to execute unreviewed commands on production hosts and bypass safer cloud API controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The firewall examples expose SSH to 0.0.0.0/0 and ::/0 without caution, encouraging globally reachable administrative access. In real deployments this materially increases attack surface and brute-force/scanning exposure, especially if users copy-paste defaults.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Deletion commands for firewalls, SSH keys, and volumes are given as routine examples without noting irreversibility or service impact. This can cause loss of access, data loss, or network exposure if an agent or user applies them in the wrong context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

## Tips

- **Use `--output json`** for parsing: `hcloud server list --output json | jq`
- **Context switching**: Create multiple contexts in `~/.config/hcloud/cli.toml` for different projects/accounts
- **Server labels**: Use labels for organization: `--labels environment=production,project=web`
- **Default location**: Set default location to avoid specifying: `hcloud context config default-location nbg1`
- **Dry run**: Many commands support `--dry-run` or `--validate` flags

Static analysis

No suspicious patterns detected.