Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add IsaiaScope/ai --skill hetzner-updategit clone --depth 1 https://github.com/IsaiaScope/aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/isaiascope/ai/hetzner-update)<a href="https://agentmods.dev/skills/isaiascope/ai/hetzner-update"><img src="https://agentmods.dev/badge/skills/isaiascope/ai/hetzner-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.02159 |
| Opus 5 | $0.00076 | $0.01079 |
| Sonnet 5 | $0.00030 | $0.00432 |
| Haiku 4.5 | $0.00015 | $0.00216 |
Grade A, and why
hetzner-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hetzner-update
Keep a self-hosted app and its local half on the same version, and refuse to cross a breaking change without asking.
Invocation: /hetzner-update [app] [--to <version>] [--check]
app is a key under software in the registry. Omit it to do every entry.
--check reports drift and stops, changing nothing.
Sibling skills: /hetzner-ssh (connect) · /hetzner-create · /hetzner-delete.
Server connection details come from the fleet roster those skills own; this skill only
names a server, never redefines one.
This changes a running production service. Step 5 always confirms before applying, and Step 4 always takes a backup first. Never skip either, and never infer approval from the invocation.
The model
Two halves that must agree, and a third thing that pretends to be one of them.
| local | the client on your Mac. Often a desktop app that self-updates and cannot be pinned |
| remote | the service on the VPS. Pinned to a tag, and the half you can actually set |
| companions | other binaries of the same name that speak to nothing. They may lag harmlessly, but they answer --version first and will lie to you about whether the halves agree |
Companions exist because a Homebrew CLI and a bundled daemon can share a name and a
$PATH. Read versions with the exact commands in the registry, never a bare binary name.
Step 0 — Load the registry
cat ~/.config/hetzner/hetzner.json
| Condition | Action |
|---|---|
| File missing | First run on this machine. Create it from the schema in README.md. Do not invent entries for apps the user has not mentioned |
| Invalid JSON | Report the parse error and the offending line. Do not rewrite the file. Stop |
Requested app not in software |
Print the available keys and stop. Never guess a neighbouring name |
Each entry names a server key. That key must exist in fleet.servers of
~/.config/hetzner/hetzner.json; if it does not, stop and say so rather than guessing an
ssh alias.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 210 lines · 151 tokens per session scan A 941dd480ff99
hetzner-update is a skill published in the GitHub repository IsaiaScope/ai (2 stars, last pushed 4d ago), licensed MIT. It adds 151 tokens to every session and 2,159 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
neo-azure-pipelines
Use this skill when the user asks to create, review, debug, or modernize Azure Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or IIS/on-premises deploys. Prefer bundled templates and verify task syntax against Microsoft docs when version-specific accuracy matters.
vercel-hygiene
Audit and harden the 4 pivoshenko brand sites on Vercel (pivoshenko.dev, pivoshenko.startpage, pivoshenko.wallpapers, pivoshenko.ai), team pivoshenko. Read-only sweep -> per-site report (ok/attention/action) -> confirmed fixes. Emphasizes security headers and analytics coverage. Use when the user says "audit vercel"…
cloudflare-hygiene
Audit + harden + optimize live Cloudflare zones/domains — read-only sweep of each zone (SSL/TLS mode, HSTS, min TLS, TLS 1.3, Always-Use-HTTPS, Brotli, HTTP/3, 0-RTT, Early Hints, caching, security level, Bot Fight Mode, WAF, DNS proxy/TTL + SPF/DKIM/DMARC hygiene, DNSSEC) -> ok/attention/action report grouped by…
agent-framework-azure-ai-py
Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code int...
agent-framework-azure-ai-py
Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming…
agent-framework-azure-ai-py
Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming…