Kube-Hetzner is an infrastructure project that uses Terraform or OpenTofu to deploy and maintain Kubernetes clusters on Hetzner Cloud. It is for operators who need highly available clusters based on k3s or RKE2, with networking, storage, ingress, certificates, and upgrades configured as part of the deployment.
Borrowing it
Nothing to install: this file belongs to mysticaltech/terraform-hcloud-kube-hetzner. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mysticaltech/terraform-hcloud-kube-hetzner/master/.claude/skills/prepare-release/SKILL.mdgit clone --depth 1 https://github.com/mysticaltech/terraform-hcloud-kube-hetznerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mysticaltech/terraform-hcloud-kube-hetzner/prepare-release)<a href="https://agentmods.dev/skills/mysticaltech/terraform-hcloud-kube-hetzner/prepare-release"><img src="https://agentmods.dev/badge/skills/mysticaltech/terraform-hcloud-kube-hetzner/prepare-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mysticaltech/terraform-hcloud-kube-hetzner/prepare-release"><img src="https://agentmods.dev/badge/skills/mysticaltech/terraform-hcloud-kube-hetzner/prepare-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 362 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 63 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.05101 |
| Opus 5 | $0.00015 | $0.02550 |
| Sonnet 5 | $0.00006 | $0.01020 |
| Haiku 4.5 | $0.00003 | $0.00510 |
Grade C, and why
prepare-release scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$tmpdir" How it starts
The opening of the file, as written. The whole thing — 502 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prepare Release
Overview
Prepare a new release by generating changelog entries, updating version references, and creating release notes.
Usage
/prepare-release
Release Authority and Automation
Do not create release tags just because this skill was invoked. By default, prepare only.
When Karim explicitly says to do the release (for example "release time" or "do the release"), run the full local release gates, create and push the annotated tag yourself, then confirm the lightweight publication workflow.
Default job:
- Prepare the changelog
- Update version references
- Generate release notes draft
- Commit preparation changes
Maintainer-authorized release job:
- Verify
masteris clean and up to date - Verify the release tag does not already exist locally or remotely
- Create and push the annotated tag
- Let
.github/workflows/publish-release.yamlpublish the already-verified tag - Confirm the workflow and GitHub release succeeded
Current Release Automation
The repository has tag-driven release automation in .github/workflows/publish-release.yaml.
Important details:
- The workflow runs only on pushed
v*tags and has no manual-dispatch path. - It extracts the Markdown release content from
CHANGELOG.md, specifically everything under## [Unreleased]until the next## [heading. - It rejects a missing, duplicate, or empty
[Unreleased]section. - It asks GitHub to append generated release notes.
- It creates the GitHub release with
ncipollo/release-action. - It does not run Terraform, Packer, HCloud, bootstrap, or cluster gates. Those are authoritative local pre-tag checks.
Therefore:
CHANGELOG.mdis the release-content Markdown file.- Keep the target release notes under
## [Unreleased]until after the release tag is pushed. - Do not move
[Unreleased]to[vX.Y.Z] - YYYY-MM-DDbefore tagging unless you are also bypassing the workflow and manually providing release notes. - Do not run
gh release createduring the normal path; the tag workflow owns publication. Use it only after re-running the local integrity gates if publication fails. - If Karim asks for a tiny release-prep correction during release, commit it on the release branch, merge it through the protected
masterpull-request path, then tag the resulting merged commit. - After a successful release, cut
CHANGELOG.md: leave## [Unreleased]genuinely empty and move the released notes under## [X.Y.Z] - YYYY-MM-DD. Do not insert placeholder text or a separator before the next release heading: either would pass the publication workflow's non-whitespace guard. Merge that cleanup through a release-maintenance pull request. - Previous release notes must never remain under
## [Unreleased]; otherwise the next tag workflow will publish stale notes again. - For v3-series releases, verify README's compact "Current release:" link points
at the latest release tag and
CHANGELOG.mdcarries the release content. - After significant releases, regenerate the machine-readable knowledge file
(
kube-hetzner-knowledge.jsondata) and confirm itsmeta.versionmatches the release. The Custom GPT was retired 2026-07-13 — the agent skills (installed vianpx skills add kube-hetzner/terraform-hcloud-kube-hetzner) are the assistant channel; the knowledge file feeds future tooling (MCP).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -1 lines 735e026b29e3
- 11d ago First seen · 503 lines · 31 tokens per session scan C ed16f7f5cc32
prepare-release is a skill published in the GitHub repository mysticaltech/terraform-hcloud-kube-hetzner (3,927 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 5,101 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
maintainer-ops
Use for vLLM Semantic Router issue intake, PR decisions, releases, and reviewed GitHub mutations performed on behalf of maintainers.
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.
publish-plugins
(project) Use when editing any file under skills/ or plugins/ to bump the plugin version and check the manifests.
pr
Use when the user explicitly asks to push the current branch and open a PR, rewrite an open PR's body from its commits, or wait for CI and merge it.
delivery-operations
Plan safe delivery with observable rollouts, rollback criteria, and operational ownership.
docs-release-notes
Produce accurate user and operator documentation with concise, evidence-based release notes.