Hetzner Cloud CLI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Hetzner Cloud CLI guide, but users should avoid copying its broad SSH firewall example without narrowing the source IP range.

Install only if you intend to let the agent help administer Hetzner Cloud resources. Review every proposed hcloud command before approving it, use the least-privileged API token possible, and do not expose SSH to the whole internet unless you have deliberately accepted that risk and hardened the server.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:78

Finding

Firewall Example Exposes SSH to the Entire IPv4 Internet

Content

View full analysis

--direction in --protocol tcp --port 22 --source-ips 0.0.0.0/0 ``` ### Technical Analysis The documented command creates an inbound firewall rule that permits traffic to TCP port 22 from `0.0.0.0/0`, representing every IPv4 address. Global SSH exposure is not necessary for the Skill's declared general-purpose Hetzner Cloud management functionality and violates least-privilege network-access principles. The rule does not itself bypass SSH authentication or grant an attacker immediate server privileges. However, it makes the SSH service reachable by arbitrary Internet hosts, substantially increasing exposure to automated scanning, credential attacks, stolen-key reuse, account misconfiguration, and exploitable SSH service vulnerabilities. The separate SSH-key example at `SKILL.md:114` reads an existing public key and registers it with Hetzner Cloud. It does not write to the key file or read a private key, and it is consistent with the declared server-management functionality. ### Attack Path 1. A user follows the documented firewall example. 2. Hetzner Cloud applies an inbound rule allowing TCP port 22 from `0.0.0.0/0`. 3. Internet scanners discover the publicly reachable SSH service. 4. An attacker attempts credential guessing, credential or private-key reuse, authentication abuse, or exploitation of a vulnerable SSH implementation. 5. If authentication or exploitation succeeds, the attacker obtains access under the compromised SSH account and may perform actions permitted to that account, potentially including administrative actions where the account has elevated privileges. ### Impact Assessment The immediate impact is unnecessary Internet-wide reachability of the server's SSH interface. Successful compromise could expose server data and ...[truncated 398 chars]

Remediation

View remediation

--direction in --protocol tcp --port 22 --source-ips 203.0.113.10/32 ``` - Prefer access through a private network, VPN, or hardened bastion host when administrators do not have stable source addresses. - Add an explicit warning that SSH must not be exposed globally unless the user understands and accepts the risk. - Require the Skill to display the exact rule and obtain explicit confirmation before creating or modifying it, consistent with its stated safety policy. - Recommend public-key authentication, disabled password and root login, current SSH packages, connection rate limiting, and authentication monitoring as defense-in-depth controls. - Validate user-supplied CIDRs before constructing the command and avoid presenting `0.0.0.0/0` as the default example. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.