Hetzner Cloud CLI

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3ab7822a8734312579ef354ca329f98a1121c260bed6a0113aa5240c8d801e57
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. It provides legitimate commands for managing Hetzner Cloud resources using the `hcloud` CLI. Crucially, the `SKILL.md` includes strong safety rules explicitly instructing the AI agent to 'NEVER execute delete commands', 'NEVER expose or log API tokens, keys, or credentials', and 'ALWAYS ask for confirmation' before modifications. While the `hcloud ssh-key create --public-key-from-file ~/.ssh/id_rsa.pub` command accesses a sensitive directory, it targets the public key for a legitimate purpose (SSH key management) and is explicitly covered by the agent's safety instructions against credential exposure.