hetzner-dev
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
hdevCLI tool to manage infrastructure andgit/ghfor repository operations. These tools are used for their intended administrative and development purposes. - [REMOTE_CODE_EXECUTION]: The skill's primary function is to execute code on remote Hetzner VMs. It uses the
hdev submitcommand to push task briefs and initiate these remote jobs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided plans and task strings which are passed to remote agents.
- Ingestion points: Data enters the context via the
plan.mdfile and-mtask arguments. - Boundary markers: The instructions use markdown headings to structure slices, but no specific delimiters or 'ignore' instructions are used to protect the remote agent from injection within the brief.
- Capability inventory: The remote agent has access to the full shell, file system, and GitHub CLI within the VM environment.
- Sanitization: No sanitization of the plan content is performed before it is processed by the remote agent.
Audit Metadata