ClawAudit verdict
hcloud
Accesses system credential store AND makes external network calls
Hetzner Cloud CLI wrapper skill that manages cloud infrastructure (servers, firewalls, SSH keys) using the official hcloud CLI tool; API token is stored in a local config file with 600 permissions, consistent with legitimate cloud infrastructure management.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses system credential store AND makes external network calls
LLM02 · ASI03
Permission integrity
network_out
Findings (4)
Possible hardcoded credential
SKILL.md · code · token = "YOUR_HETZNER_API_TOKEN
References sudo — requests elevated privileges
SKILL.md · code · sudo
References SSH/GPG private keys
SKILL.md · code · ssh-key
Accesses .ssh directory
SKILL.md · code · .ssh/
Permissions & capabilities
No declared permissions — minimal attack surface.
network_outnetwork_incredential_store Thanks — recorded.