Hetzner live firewall rule guard
Skill Raishin/vanguard-frontier-agentic/skills/hetzner/hetzner-live-firewall-rule-guard
Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.
npx -y skills add Raishin/vanguard-frontier-agentic --skill hetzner-live-firewall-rule-guardAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Guard Hetzner Cloud Firewall rule mutations and server attachment changes with mandatory pre-mutation snapshot of current rules, blast-radius review, explicit human approval, target confirmation, account, region, and rollback plan. Use only when live Firewall rule changes are required and all pre-flight checks are confirmed.
SKILL.md
3.4 KB, 624 tokens by cl100k_base, as published. Nobody here has run it
Hetzner Cloud Live Firewall Rule Guard
Purpose
Act as the Hetzner Cloud live Firewall rule guard: enforce pre-mutation snapshot, blast-radius review, and rollback plan before any Firewall rule mutation or attachment change proceeds.
When to use
Use this skill ONLY when:
- A live Hetzner Cloud Firewall rule mutation (add, update, delete inbound or outbound rule) is confirmed and approved
- A Firewall attachment to servers or Label groups needs to change
- A Firewall needs to be created or deleted
- All hard-stop pre-flight checks have been confirmed by an explicit human approver
Do NOT use this skill for advisory Firewall review — use hetzner-infrastructure-reviewer for that.
Hard-stop pre-flight checks (all required before any mutation)
- Snapshot current Firewall rules:
GET /v1/firewalls/{id}— store as rollback evidence - Review blast-radius:
GET /v1/firewalls/{id}resources field — list all attached servers and Label groups - Confirm target Firewall ID and project context
- Confirm account, region (fsn1 / nbg1 / hel1), and rollback plan (rule revert procedure or Firewall detach)
- Receive explicit human approval naming this specific Firewall and rule change
Lean operating rules
- Hetzner Cloud has no official Terraform provider — recommend API-driven automation (curl, Python hcloud SDK) over community Terraform alternatives. If MCP tooling is unavailable, say: "I can't access live Hetzner MCP here, so I'm falling back to official docs." Then use https://docs.hetzner.cloud/ and Context7 as fallback.
- Verify API token is project-scoped before any write operation.
- Public IPs are opt-in since API v1.34 — verify exposure before and after Firewall changes.
- Hetzner Firewall rule changes take effect immediately and affect all attached servers.
- An unattached Hetzner Firewall provides zero protection — verify attachment state before and after changes.
- Label facts as
live evidence,user-provided sanitized evidence,documentation-based, orinference. - Challenge broad 0.0.0.0/0 inbound additions and rules exposing management ports (SSH 22, RDP 3389) to the public internet.
References
Load these only when needed:
- Workflow and output contract — use when executing the full Firewall mutation or formatting the final answer.
- Safety checklist — use before privileged, destructive, or production-impacting recommendations.
- Official sources — use when grounding Hetzner Cloud Firewall behavior or checking the source list.
Response minimum
Return, at minimum:
- pre-flight check status (all passed or blocking reason),
- the exact API call that will be executed (show before executing),
- blast-radius summary (servers and Label groups affected),
- rollback procedure confirmed,
- post-change verification steps.