📦 syself-autopilot-hetzner — 一键部署Hetzner集群
v1.0.0在Hetzner云快速完成Kubernetes集群全生命周期管理：自动配置kubeconfig、命名空间、ClusterStack与Cluster清单，并同步账户与凭证，实现零手动干预的云端集群落地。
0· 262·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This package contains useful templates and scripts for SySelf Autopilot on Hetzner, but the registry metadata fails to declare the sensitive inputs the scripts require. Before installing or running: 1) Verify the skill source and trustworthiness (source is unknown). 2) Inspect the scripts (you already have them) and confirm you are comfortable running kubectl and bash locally. 3) Understand that the scripts expect a management kubeconfig and will read environment variables and local private SSH ...详细分析 ▾
⚠ 用途与能力
The name/description and the included templates/scripts align with SySelf Autopilot on Hetzner (kubeconfig preparation, ClusterStack/Cluster manifests, Hetzner bare metal onboarding). However the registry metadata claimed 'Required env vars: none' and 'Required config paths: none' while several scripts clearly require a management kubeconfig and Hetzner credentials (HCLOUD_TOKEN, HETZNER_ROBOT_USER, HETZNER_ROBOT_PASSWORD, SSH key paths). That mismatch between claimed requirements and actual files is an incoherence.
ℹ 指令范围
The SKILL.md and scripts stay within the expected workflow: preparing a management kubeconfig, applying manifests, and creating Kubernetes secrets for Hetzner credentials and SSH keys. They instruct reading local kubeconfig files and local SSH key files and calling kubectl and optionally hcloud. This is sensitive but within the stated purpose; the skill does not attempt obvious exfiltration or network calls to unknown endpoints in the provided files.
✓ 安装机制
No install spec is present (instruction-only plus script files). No downloads or archive extraction are performed. Risk from installation is low, but runtime requires executing the included shell scripts on a host with kubectl and optional hcloud available.
⚠ 凭证需求
The scripts require multiple sensitive environment values and file paths (HCLOUD_TOKEN, Robot user/password, SSH key paths, SSH_KEY_NAME, and a kubeconfig file). These are appropriate for Hetzner/SySelf onboarding, but the skill metadata did not declare them — that omission is a red flag because a user installing the skill could be unaware that the skill will read secrets and private keys. The scripts will create Kubernetes secrets from those inputs (which is expected behavior) but handling of private key files and tokens deserves explicit disclosure.
✓ 持久化与权限
The skill is not always:true and does not request system-wide persistence. It operates by running scripts and issuing kubectl/hcloud commands against a management cluster the operator must supply. It does create secrets inside the target Kubernetes cluster (expected for its purpose), but it does not modify other skills or agent-wide configuration in the provided files.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install syself-autopilot-hetzner
镜像加速npx clawhub@latest install syself-autopilot-hetzner --registry https://cn.longxiaskill.com