hetzner-storage-box

name	hetzner-storage-box
description	Read and operate Hetzner Storage Boxes through Hetzner API management calls and WebDAV file requests with gateway-injected credentials.
user-invocable	true
requires	{"bins":["node"]}
credentials	[{"id":"hetzner-api-token","kind":"bearer","required":true,"secret_ref":{"source":"store","id":"HETZNER_API_TOKEN"},"scope":"api.hetzner.com/v1/storage_boxes","how_to_obtain":"Create a Hetzner Console API token for the project containing the Storage Box. Use read-only scope for inventory and read-write scope only for approved Storage Box management changes. Set `HETZNER_API_TOKEN` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set HETZNER_API_TOKEN \"<hetzner-console-api-token>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set HETZNER_API_TOKEN \"<hetzner-console-api-token>\"`."},{"id":"hetzner-storage-box-basic-auth","kind":"header","required":false,"secret_ref":{"source":"store","id":"HETZNER_STORAGE_BOX_BASIC_AUTH"},"scope":"*.your-storagebox.de WebDAV Authorization header","how_to_obtain":"Base64-encode '<storage-box-username>:<password>' and store only that encoded value. Set `HETZNER_STORAGE_BOX_BASIC_AUTH` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set HETZNER_STORAGE_BOX_BASIC_AUTH \"<base64-username-password>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set HETZNER_STORAGE_BOX_BASIC_AUTH \"<base64-username-password>\"`. The helper injects it as 'Authorization: Basic <secret>' for WebDAV file operations."}]
metadata	{"hybridclaw":{"category":"infrastructure","short_description":"Hetzner Storage Box inventory, snapshots, and guarded WebDAV file operations.","tags":["hetzner","storage-box","webdav","archive","infrastructure"],"stakes_tiers":{"green":"[Truncated]","amber":"[Truncated]","red":"[Truncated]"},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"hetzner-storage-box"}}}

Hetzner Storage Box

Use this skill for Storage Box inventory, lifecycle and snapshot management, plus WebDAV file reads and guarded uploads/archives.

Default Workflow

1. Use Hetzner API reads (list-storage-boxes, get-storage-box) for inventory and metadata.
2. Use WebDAV reads (list-files, download-file) for file inspection.
3. Use plan before any management, file write, or public-link request.
4. Treat hetzner_storage_box.cjs as the API/WebDAV wrapper. Do not handcraft Hetzner Storage Box API URLs, WebDAV URLs, JSON bodies, tiers, or secret refs from memory.
5. For prompt/user testing, stop after plan or after helper payload generation. Do not call the built-in http_request tool.
6. For real user requests that need live Storage Box API or WebDAV reads, pass the helper-emitted httpRequest object unchanged to http_request. The bearerSecretName or secretHeaders field is the secret reference; do not rewrite it, preflight it, inspect it, or ask the model for the secret.
7. If a live http_request call returns 401 or 403, stop after that first failure. Do not retry, do not fan out to more endpoints or paths, and ask the operator to set or verify the relevant secret.
8. Require explicit operator grant before creating boxes, changing settings, snapshots, uploads, archives, directory creation, public sharing, or deletes.
9. Never paste, print, or inspect HETZNER_API_TOKEN or Storage Box passwords. The gateway injects API bearer tokens and WebDAV Basic auth server-side.

Secret Setup

API management calls use HETZNER_API_TOKEN. Set or update it in this order:

1. Browser admin: open the active HybridClaw admin URL ending in /admin/secrets.
2. Browser /chat or TUI fallback: /secret set HETZNER_API_TOKEN "<hetzner-console-api-token>".
3. Local console fallback:

hybridclaw secret set HETZNER_API_TOKEN "<hetzner-console-api-token>"

HETZNER_API_TOKEN is the Hetzner Console token for Cloud and Storage Box management APIs. DNS uses its own HETZNER_DNS_API_TOKEN because Hetzner DNS is served by a separate DNS API and header.