Menu
Read and manage Hetzner DNS zones and records through gateway-proxied DNS API requests with guarded A, AAAA, CNAME, and TXT changes.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Assess a codebase or app for ISO/IEC 27001:2022 readiness — detect technical security evidence, map it to Annex A controls, status each control (implemented/partial/missing/N-A), and produce an SoA-style gap report grounded in the standard's structure. Covers the ISMS clauses (4–10), the 93 Annex A controls in 4 themes, the 11 new 2022 controls, certification & the Statement of Applicability, risk assessment/treatment, and the 2024 climate amendment. A readiness aide, not a certification or legal/audit advice. Grounding pack current to 22 June 2026.
Assess whether a codebase or app complies with the EU AI Act (Regulation (EU) 2024/1689) — detect AI usage, classify the risk tier, determine provider/deployer role, map obligations, and produce a grounded, citation-backed gap report. Grounding pack current to 22 June 2026.
Apply the EU GDPR (Regulation (EU) 2016/679) and the German DSGVO/BDSG + TTDSG/TDDDG to real compliance work, grounded in the regulation rather than memory. Covers data-subject rights (Art. 12–22), records of processing/ROPA (Art. 30), data protection impact assessments/DPIA (Art. 35), processors and DPA/AVV (Art. 28), international transfers and SCCs (Art. 44–49), consent and cookie/ePrivacy rules (Art. 6/7 + TTDSG/TDDDG §25), personal-data breach notification (Art. 33/34), and security of processing (Art. 32). Cite the article, run the deadline-bound workflows, and draft ROPA/DPIA/DPA/privacy-notice/consent records from bundled templates. A structured compliance aide, not legal advice.
Use Langfuse for LLM observability and evaluation and look up Langfuse documentation. In HybridClaw, data access (traces, observations, sessions, scores, prompts, datasets, metrics) goes through the gateway-proxied langfuse.cjs helper with SecretRef auth — reads are green, writes are grant-gated. Documentation retrieval uses langfuse.com llms.txt, markdown pages, and search-docs. Covers instrumentation, prompt migration, error analysis, and LLM-as-a-judge calibration.
Read and operate Hetzner Cloud servers, server types, locations, networks, volumes, snapshots, and cost estimates through gateway-proxied API requests.
Read and operate Hetzner Storage Boxes through Hetzner API management calls and WebDAV file requests with gateway-injected credentials.
| name | hetzner-dns |
| description | Read and manage Hetzner DNS zones and records through gateway-proxied DNS API requests with guarded A, AAAA, CNAME, and TXT changes. |
| user-invocable | true |
| requires | {"bins":["node"]} |
| credentials | [{"id":"hetzner-dns-api-token","kind":"header","required":true,"secret_ref":{"source":"store","id":"HETZNER_DNS_API_TOKEN"},"scope":"dns.hetzner.com/api/v1","how_to_obtain":"Create a DNS API access token in the Hetzner DNS Console and store it as HETZNER_DNS_API_TOKEN. The helper injects it into the Auth-API-Token header server-side."}] |
| metadata | {"hybridclaw":{"category":"infrastructure","short_description":"Hetzner DNS zone and record reads plus guarded record changes.","tags":["hetzner","dns","records","infrastructure"],"stakes_tiers":{"green":["list-zones","get-zone","list-rrsets","get-rrset"],"amber":["create-rrset","update-rrset","add-record","remove-record"],"red":["delete-record","delete-rrset","delete-zone"]},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"hetzner-dns"}}} |
Use this skill for Hetzner DNS zone discovery and A, AAAA, CNAME, TXT, and other record management through the Hetzner DNS API.
list-rrsets to discover existing record
ids before update or delete requests.plan before mutations so the operator can see the tier and required
grant.hetzner_dns.cjs as the API wrapper. Do not handcraft Hetzner DNS API
URLs, JSON bodies, tiers, or secret refs from memory.plan or after helper http-request
payload generation. Do not call the built-in http_request tool.httpRequest object unchanged to http_request. The
secretHeaders entry for Auth-API-Token is the secret reference; do not
preflight it, inspect it, or ask the model for the token.http_request call returns 401 or 403, stop after that first
failure. Do not retry, do not fan out to more endpoints, and ask the operator
to set or verify HETZNER_DNS_API_TOKEN.--operator-grant only after that grant.HETZNER_DNS_API_TOKEN; the gateway injects
it server-side as Auth-API-Token.See references/operator-setup.md for DNS token setup, scope, autonomy defaults, and record-id handling.
node skills/hetzner-dns/hetzner_dns.cjs --help
Plan a DNS request without contacting Hetzner:
node skills/hetzner-dns/hetzner_dns.cjs --format json plan "Point demo-acme.example.com at the demo VPS"
Build read requests:
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request list-zones
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request list-rrsets --zone-id zone123 --name demo --type A
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request get-rrset --record-id record123
Build guarded write requests:
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request create-rrset \
--zone-id zone123 --name demo --type A --ttl 300 --record 203.0.113.10 \
--operator-grant
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request update-rrset \
--record-id record123 --zone-id zone123 --name demo --type A --ttl 300 --record 203.0.113.11 \
--operator-grant
node skills/hetzner-dns/hetzner_dns.cjs --format json http-request delete-record \
--record-id record123 --operator-grant
create-rrset and add-record emit one DNS API record create request. For
multiple values, build one request per value.update-rrset only with an exact --record-id from a prior read.remove-record, delete-record, or delete-rrset only with an exact
--record-id.@ for apex records when the API requires a record name.delete-record, delete-rrset, delete-zone)
unless the operator grants the exact record id or zone id target.UsageTotals; helper output
includes costMeasurement.system = "UsageTotals" for eval verification.node skills/hetzner-dns/hetzner_dns.cjs --format json eval-scenarios
The fixture at evals/scenarios.json contains 10 DNS scenarios covering zone
reads, record reads, A/AAAA/CNAME/TXT changes, and guarded deletes.
python3 skills/skill-creator/scripts/quick_validate.py skills/hetzner-dns
node skills/hetzner-dns/hetzner_dns.cjs --help
node skills/hetzner-dns/hetzner_dns.cjs --format json eval-scenarios