vps-hybrid-networking 1.0.1 → 1.0.2

package/README.md

@@ -67,10 +67,12 @@ hermes skills install AnandaAp/vps-hybrid-networking/skills/vps-hybrid-networkin
 
 Hermes security-scans skills on install. You can also register this repo as a reusable source once with `hermes skills tap add AnandaAp/vps-hybrid-networking`.
 
+> **Note on the Hermes security scan:** this skill is a root-level server-administration runbook, so Hermes' pattern scanner flags its subject matter (`sudo`, systemd units, files under `/etc`, network tunnels) and hub installs are currently blocked with a "dangerous" verdict. The flagged operations are the setup itself, run on your own server with your own tokens — but review the findings before trusting any skill, including this one. If you have reviewed it and want it anyway, install manually: copy `skills/vps-hybrid-networking/` into your Hermes skills folder (`%LOCALAPPDATA%\hermes\skills\` on Windows, `~/.hermes/skills\` elsewhere) and restart Hermes.
+
 ### npm / npx installer (this repo's own package)
 
 ```bash
-npx vps-hybrid-networking@1.0.1
+npx vps-hybrid-networking@1.0.2
 ```
 
 Auto-detects your installed agents and copies the skill into each one's skills folder. Targets: Claude Code, Antigravity, Codex / agents standard, Gemini CLI, OpenCode, Cursor, Hermes Agent, Cline, Roo Code, Goose, Amp, Windsurf, Kiro CLI, Qwen Code, GitHub Copilot, Trae, and Continue. Useful flags: `--all`, `--agent claude-code,antigravity`, `--list`, `--dry-run`. (If the npm package is not yet published, clone this repo and run `node bin/install.mjs --all` — it is the same code with the same result.)
@@ -86,7 +88,7 @@ The npm installer is built to be boring and auditable:
 - **Zero dependencies** — Node.js standard library only; there is no dependency tree to compromise.
 - **No install hooks** — `package.json` defines no lifecycle scripts, so nothing runs implicitly on `npm install`/`npx`. The installer runs only when you invoke it.
 - **No network, no execution** — the installer never downloads anything and never spawns a process. It only copies the skill files bundled inside the package into a fixed allow-list of well-known agent folders, and it verifies every destination stays inside its allow-listed folder before copying.
-- **Pin the version** (`npx vps-hybrid-networking@1.0.1`) if you want reproducible installs, and read [`bin/install.mjs`](bin/install.mjs) — it is short on purpose.
+- **Pin the version** (`npx vps-hybrid-networking@1.0.2`) if you want reproducible installs, and read [`bin/install.mjs`](bin/install.mjs) — it is short on purpose.
 - Prefer not to run third-party installers at all? Use `npx skills add` (which pulls straight from GitHub) or the manual copy above.
 
 ## What's inside
@@ -123,6 +125,7 @@ skills/vps-hybrid-networking/   the skill itself (SKILL.md + scripts/)
 .agents/plugins/                Codex marketplace catalog
 plugin.json                     Agent Plugins standard manifest (Codex/Cursor portable layout)
 gemini-extension.json           Gemini CLI extension manifest
+assets/logo.jpg                 plugin logo (Antigravity Marketplace)
 package.json + bin/install.mjs  the zero-dependency npm/npx installer
 ```
 

package/package.json

@@ -1 +1 @@
-{"author":"Ananda Apriliansyah Cahya Utama","bin":{"vps-hybrid-networking":"bin/install.mjs"},"description":"Installer for the vps-hybrid-networking agent skill \u2014 serves a NAT-blocked VPS via Tailscale + Cloudflare Tunnel + Caddy (DNS-01). Zero dependencies, no install hooks, no network access.","engines":{"node":">=18"},"files":["bin/install.mjs","skills","README.md","LICENSE"],"homepage":"https://github.com/AnandaAp/vps-hybrid-networking#readme","keywords":["agent-skill","claude-code","antigravity","codex","gemini-cli","opencode","cursor","hermes-agent","cline","roo-code","goose","amp","windsurf","kiro-cli","qwen-code","github-copilot","trae","continue","vps","caddy","cloudflare-tunnel","tailscale"],"license":"MIT","name":"vps-hybrid-networking","publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/AnandaAp/vps-hybrid-networking.git"},"type":"module","version":"1.0.1"}
+{"author":"Ananda Apriliansyah Cahya Utama","bin":{"vps-hybrid-networking":"bin/install.mjs"},"description":"Installer for the vps-hybrid-networking agent skill \u2014 serves a NAT-blocked VPS via Tailscale + Cloudflare Tunnel + Caddy (DNS-01). Zero dependencies, no install hooks, no network access.","engines":{"node":">=18"},"files":["bin/install.mjs","skills","README.md","LICENSE"],"homepage":"https://github.com/AnandaAp/vps-hybrid-networking#readme","keywords":["agent-skill","claude-code","antigravity","codex","gemini-cli","opencode","cursor","hermes-agent","cline","roo-code","goose","amp","windsurf","kiro-cli","qwen-code","github-copilot","trae","continue","vps","caddy","cloudflare-tunnel","tailscale"],"license":"MIT","name":"vps-hybrid-networking","publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/AnandaAp/vps-hybrid-networking.git"},"type":"module","version":"1.0.2"}

package/skills/vps-hybrid-networking/SKILL.md

@@ -152,8 +152,12 @@ sudo killall python3
 ### Stage 2: Private Network Setup via Tailscale
 
 ```bash
-# 1. Install official Tailscale package
-curl -fsSL https://tailscale.com/install.sh | sh
+# 1. Install Tailscale from its official apt repository (no pipe-to-shell installer).
+#    Replace <distro> with ubuntu or debian and <codename> with your
+#    release codename (e.g. noble for Ubuntu 24.04, bookworm for Debian 12).
+curl -fsSL https://pkgs.tailscale.com/stable/<distro>/<codename>.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
+curl -fsSL https://pkgs.tailscale.com/stable/<distro>/<codename>.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
+sudo apt-get update && sudo apt-get install -y tailscale
 
 # 2. Connect machine to your Tailnet
 sudo tailscale up --hostname=my-vps --accept-routes
@@ -282,13 +286,13 @@ sudo apt-get update && sudo apt-get install -y cloudflared
 
 # 2. Store the tunnel token in a protected file
 sudo mkdir -p /etc/cloudflared
-sudo bash -c 'cat << "EOF" > /etc/cloudflared/token
+sudo tee /etc/cloudflared/token > /dev/null <<'EOF'
 <YOUR_CLOUDFLARE_TUNNEL_TOKEN>
-EOF'
+EOF
 sudo chmod 600 /etc/cloudflared/token
 
 # 3. Create Systemd Service File: /etc/systemd/system/cloudflared.service
-sudo bash -c 'cat << "EOF" > /etc/systemd/system/cloudflared.service
+sudo tee /etc/systemd/system/cloudflared.service > /dev/null <<'EOF'
 [Unit]
 Description=Cloudflare Tunnel client
 After=network-online.target
@@ -303,7 +307,7 @@ RestartSec=5s
 
 [Install]
 WantedBy=multi-user.target
-EOF'
+EOF
 
 # 4. Reload systemd and start the tunnel daemon
 sudo systemctl daemon-reload