Home / mysticaltech / terraform-hcloud-kube-hetzner
AI Slop Code RIsk Monitor

mysticaltech/terraform-hcloud-kube-hetzner

Optimized and Maintenance-free Kubernetes on Hetzner Cloud in one command!

5.7 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for mysticaltech/terraform-hcloud-kube-hetzner, a HCL project with 3,937 GitHub stars. SynthScan examined 47,980 lines of code across 171 source files, recording 197 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 5.7 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.7
Adjusted Signal
5.7
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
3.9K
Stars
HCL
Language
48.0K
Lines of Code
171
Files
197
Pattern Hits
2026-10-12
Scan Date
0.08
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 20.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 173 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.2/100 · LOW

Are imports declared and package/API names verified? 21 finding(s).

Agent Over-Engineering Ratio 7.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 70 finding(s).

PR Review Velocity Impact 25.1/100 · MEDIUM

Which changes need focused human review? 197 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 13MEDIUM 8LOW 176

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 197 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Structural Annotation Overuse65 hits · 103 pts
SeverityFileLineSnippetContext
LOW⚡.claude/skills/debug-node/SKILL.md49## Step 1: Identify the ServerCOMMENT
LOW⚡.claude/skills/debug-node/SKILL.md55## Step 2: Enable Rescue Mode & RebootCOMMENT
LOW⚡.claude/skills/debug-node/SKILL.md65## Step 3: SSH into RescueCOMMENT
LOW⚡.claude/skills/debug-node/SKILL.md71## Step 4: Mount the FilesystemCOMMENT
LOW.claude/skills/debug-node/SKILL.md98## Step 5: Diagnostic ChecklistCOMMENT
LOW.claude/skills/debug-node/SKILL.md211## Step 6: Apply a FixCOMMENT
LOW.claude/skills/debug-node/SKILL.md232## Step 7: Reboot to NormalCOMMENT
LOW.claude/skills/test-changes/SKILL.md52## Step 1: Format CheckCOMMENT
LOW.claude/skills/test-changes/SKILL.md61## Step 2: Forbid null_resource UsageCOMMENT
LOW⚡.claude/skills/test-changes/SKILL.md75## Step 3: Initialize Local ProvidersCOMMENT
LOW⚡.claude/skills/test-changes/SKILL.md84## Step 4: Validate ModuleCOMMENT
LOW⚡.claude/skills/test-changes/SKILL.md93## Step 5: Validate OpenTofu CompatibilityCOMMENT
LOW.claude/skills/test-changes/SKILL.md111## Step 6: Validate `kube.tf.example` ParseabilityCOMMENT
LOW.claude/skills/test-changes/SKILL.md169## Step 7: Initialize Test EnvironmentCOMMENT
LOW.claude/skills/test-changes/SKILL.md178## Step 8: Plan Against Test ClusterCOMMENT
LOW.claude/skills/test-changes/SKILL.md218## Step 9: Review Plan OutputCOMMENT
LOW.claude/skills/triage-issue/SKILL.md48## Step 1: Fetch Issue DetailsCOMMENT
LOW.claude/skills/triage-issue/SKILL.md58## Step 2: Classify Issue TypeCOMMENT
LOW.claude/skills/triage-issue/SKILL.md83## Step 3: Check for DuplicatesCOMMENT
LOW.claude/skills/triage-issue/SKILL.md96## Step 4: Security AnalysisCOMMENT
LOW.claude/skills/triage-issue/SKILL.md128## Step 5: Draft ResponseCOMMENT
LOW.claude/skills/triage-issue/SKILL.md223## Step 6: Recommend ActionCOMMENT
LOW.claude/skills/sync-docs/SKILL.md66## Step 1: Extract Variables from SourceCOMMENT
LOW.claude/skills/sync-docs/SKILL.md78## Step 2: Find Undocumented VariablesCOMMENT
LOW.claude/skills/sync-docs/SKILL.md87## Step 3: Generate DocumentationCOMMENT
LOW.claude/skills/sync-docs/SKILL.md114## Step 4: Update docs/llms.mdCOMMENT
LOW.claude/skills/sync-docs/SKILL.md138## Step 5: Update kube.tf.exampleCOMMENT
LOW.claude/skills/sync-docs/SKILL.md152## Step 6: Update README if NeededCOMMENT
LOW.claude/skills/sync-docs/SKILL.md244## Step 7: Verify ConsistencyCOMMENT
LOW.claude/skills/review-pr/SKILL.md57## Step 1: Fetch PR DetailsCOMMENT
LOW.claude/skills/review-pr/SKILL.md73## Step 2: Assess Author RiskCOMMENT
LOW.claude/skills/review-pr/SKILL.md93## Step 3: Analyze Changed FilesCOMMENT
LOW.claude/skills/review-pr/SKILL.md132## Step 4: Security ReviewCOMMENT
LOW.claude/skills/review-pr/SKILL.md161## Step 5: Backward CompatibilityCOMMENT
LOW.claude/skills/review-pr/SKILL.md207## Step 6: Code QualityCOMMENT
LOW.claude/skills/review-pr/SKILL.md221## Step 7: Release ClassificationCOMMENT
LOW.claude/skills/review-pr/SKILL.md246## Step 8: MANDATORY - Independent VerificationCOMMENT
LOW.claude/skills/review-pr/SKILL.md336## Step 9: Final RecommendationCOMMENT
LOW.claude/skills/prepare-release/SKILL.md106## Step 1: Analyze ChangesCOMMENT
LOW.claude/skills/prepare-release/SKILL.md126## Step 2: Classify Release TypeCOMMENT
LOW.claude/skills/prepare-release/SKILL.md145## Step 3: Update CHANGELOG.mdCOMMENT
LOW.claude/skills/prepare-release/SKILL.md190## Step 4: Update Version BadgesCOMMENT
LOW.claude/skills/prepare-release/SKILL.md203## Step 5: Update Knowledge File (if applicable)COMMENT
LOW.claude/skills/prepare-release/SKILL.md217## Step 6: Verify Release Notes ContentCOMMENT
LOW.claude/skills/prepare-release/SKILL.md352## Step 7: Commit PreparationCOMMENT
LOW.claude/skills/fix-issue/SKILL.md45## Step 1: Fetch Issue DetailsCOMMENT
LOW.claude/skills/fix-issue/SKILL.md55## Step 2: Classify Issue TypeCOMMENT
LOW.claude/skills/fix-issue/SKILL.md82## Step 3: Verify Before FixingCOMMENT
LOW.claude/skills/fix-issue/SKILL.md100## Step 4: Deep InvestigationCOMMENT
LOW.claude/skills/fix-issue/SKILL.md133## Step 5: Enter Plan ModeCOMMENT
LOW.claude/skills/fix-issue/SKILL.md145## Step 6: Implement FixCOMMENT
LOW.claude/skills/fix-issue/SKILL.md162## Step 7: Test ChangesCOMMENT
LOW.claude/skills/fix-issue/SKILL.md202## Step 8: Commit & PushCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md106## Step 1: Sync Branch and Run GatesCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md123## Step 2: Kill Stale Runs and Clean StateCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md165## Step 3: Verify Snapshot PrerequisitesCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md202## Step 4: Run Matrix (Simple to Complex)COMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md218## Step 5: Proactive Debugging During RunsCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md309## Step 6: Fix + Targeted Rerun LoopCOMMENT
LOW.claude/skills/running-stabilization-loop/SKILL.md334## Step 7: Full Regression RerunCOMMENT
5 more matches not shown…
Hyper-Verbose Identifiers67 hits · 55 pts
SeverityFileLineSnippetContext
LOWscripts/sync_docs_site.py48def _rewrite_repo_relative_links(markdown: str) -> str:CODE
LOWscripts/sync_docs_site.py205def _extract_configuration_keys(example: str) -> list[str]:CODE
LOWscripts/render_harness.py140def extract_addon_default_versions() -> dict[str, str]:CODE
LOWscripts/render_harness.py176def assert_addon_default_versions() -> None:CODE
LOWscripts/render_harness.py195def assert_agent_floating_ip_config_contract() -> None:CODE
LOWscripts/render_harness.py333def assert_agent_extra_firewall_ids_contract(scratch: "TerraformScratch") -> None:CODE
LOWscripts/render_harness.py401def assert_hcloud_ssh_key_selector_contract(scratch: "TerraformScratch") -> None:CODE
LOWscripts/render_harness.py463def assert_calico_kustomization_contract() -> None:CODE
LOWscripts/render_harness.py503def assert_autoscaler_network_env_contract() -> None:CODE
LOWscripts/render_harness.py519def assert_autoscaler_user_data_limit_contract() -> None:CODE
LOWscripts/render_harness.py567def assert_static_user_data_limit_contract() -> None:CODE
LOWscripts/render_harness.py594def assert_secrets_encryption_lifecycle_contract() -> None:CODE
LOWscripts/render_harness.py765def assert_config_update_bootstrap_contract(scratch: TerraformScratch) -> None:CODE
LOWscripts/render_harness.py886def assert_opensuse_ssh_cloudinit_contract() -> None:CODE
LOWscripts/render_harness.py918def assert_baked_selinux_package_contract() -> None:CODE
LOWscripts/render_harness.py1045def assert_kubernetes_artifact_architecture_contract() -> None:CODE
LOWscripts/render_harness.py1374def run_autoscaler_overlay_retry_simulation(overlay_script: str) -> None:CODE
LOWscripts/render_harness.py1476def run_post_install_readiness_deployment_retry_simulation(script: str) -> None:CODE
LOWscripts/render_harness.py1551def run_post_install_readiness_deadline_simulation(script: str) -> None:CODE
LOWscripts/render_harness.py1681def run_autoscaler_standard_node_ip_simulation(node_ip_script: str) -> None:CODE
LOWscripts/render_harness.py1763def run_autoscaler_standard_public_fallback_failure_simulation(node_ip_script: str) -> None:CODE
LOWscripts/render_harness.py1835def run_autoscaler_standard_node_ip_checks() -> None:CODE
LOWscripts/render_harness.py1876def assert_health_checker_first_boot_contract() -> None:CODE
LOWscripts/render_harness.py1906def assert_static_os_update_service_ordering_contract() -> None:CODE
LOWscripts/render_harness.py1940def run_autoscaler_os_upgrade_timer_checks() -> None:CODE
LOWscripts/render_harness.py2066def run_metadata_route_repair_checks() -> None:CODE
LOWscripts/render_harness.py2201def run_autoscaler_tailscale_bootstrap_scope_checks() -> None:CODE
LOWscripts/render_harness.py2367def node_annotation_write_files(scratch: TerraformScratch) -> list[dict[str, str]]:STRING
LOWscripts/render_harness.py2404def render_cloudinit_with_vars(render_vars: dict[str, Any], template_path: Path) -> tuple[str, Any]:STRING
LOWscripts/render_harness.py2413def assert_node_annotation_payload(name: str, document: Any, rendered: str) -> None:STRING
LOWscripts/render_harness.py2478def run_node_annotation_cloudinit_checks(scratch: TerraformScratch) -> None:STRING
LOWscripts/render_harness.py2518def run_autoscaler_overlay_node_ip_checks() -> None:STRING
LOWscripts/render_harness.py2588def run_autoscaler_manifest_checks(scratch: TerraformScratch) -> None:STRING
LOWscripts/render_harness.py2790def run_kustomization_path_checks(scratch: TerraformScratch) -> None:STRING
LOWscripts/smoke_v3_plan_matrix.py163def discover_external_network_id(env: dict[str, str]) -> str | None:STRING
LOWscripts/contract_negative_tests.py209def provider_reachability_blocked(output: str) -> bool:CODE
LOWscripts/contract_negative_tests.py237def provider_rpc_sockets_available() -> bool:CODE
LOWscripts/v2_to_v3_migration_assistant.py250def collect_topology_warnings(root: Path) -> list[TopologyWarning]:CODE
LOWscripts/v2_to_v3_migration_assistant.py318def find_control_plane_network_id(root: Path) -> list[str]:CODE
LOWscripts/v2_to_v3_migration_assistant.py381def server_network_update_note(change: dict[str, Any]) -> str:CODE
LOWscripts/validate_tailscale_large_scale_examples.py73def extract_named_block_count(text: str, name: str) -> int:CODE
LOWscripts/validate_tailscale_large_scale_examples.py92def placement_groups_for_static_counts(*counts: int) -> int:CODE
LOWscripts/validate_tailscale_large_scale_examples.py96def validate_secure_tailscale_exposure(text: str, example_name: str) -> dict[str, bool]:CODE
LOWscripts/tests/test_migration_network_plan.py67 def test_inline_attachment_adoption_with_unknown_ip_is_blocker(self):CODE
LOWscripts/tests/test_migration_network_plan.py78 def test_blind_control_plane_ip_restore_is_blocker(self):CODE
LOWscripts/tests/test_migration_network_plan.py86 def test_nat_enable_is_blocker_without_server_replacement(self):CODE
LOWscripts/tests/test_migration_network_plan.py99 def test_unknown_network_values_are_not_a_clean_bill(self):CODE
LOWscripts/tests/test_migration_network_plan.py112 def test_label_only_update_is_not_a_network_blocker(self):CODE
LOWscripts/tests/test_migration_network_plan.py128 def test_network_set_reordering_is_not_a_change(self):CODE
LOWscripts/tests/test_migration_network_plan.py139 def test_alias_ip_set_reordering_is_not_a_change(self):CODE
LOWscripts/tests/test_migration_network_plan.py151 def test_new_servers_and_noops_are_not_upgrade_blockers(self):CODE
LOWscripts/tests/test_migration_network_plan.py163 def test_known_empty_blocks_are_equivalent(self):CODE
LOWscripts/tests/test_migration_network_plan.py171 def test_non_network_update_and_terraform_data_replacement_keep_old_behavior(self):CODE
LOWscripts/tests/test_migration_network_plan.py184 def test_strict_cli_fails_for_attachment_or_nat_but_not_label_only(self):CODE
LOWscripts/tests/test_migration_network_plan.py223 def test_reports_do_not_call_in_place_update_a_destruction(self):CODE
LOWscripts/tests/test_haproxy_proxy_protocol.py112 def test_render_preserves_defaults_and_appends_exact_peers(self):STRING
LOWscripts/tests/test_haproxy_proxy_protocol.py118 def test_native_trusted_and_untrusted_transport_sources(self):STRING
LOWscripts/tests/test_cilium_intake.py32 def test_cilium_without_legacy_inputs_still_warns(self) -> None:CODE
LOW⚡scripts/tests/test_cilium_intake.py44 def test_computed_selection_is_not_assumed_to_be_non_cilium(self) -> None:CODE
LOW⚡scripts/tests/test_cilium_intake.py50 def test_explicit_kube_proxy_choice_still_needs_transition_review(self) -> None:CODE
7 more matches not shown…
Cross-Language Confusion10 hits · 30 pts
SeverityFileLineSnippetContext
HIGHscripts/render_harness.py1857 "private route probe tolerates retry": "ip -4 route get '10.0.0.1' 2>/dev/null || true",CODE
HIGHscripts/render_harness.py1389 count=$(cat "$file" 2>/dev/null || echo 0)STRING
HIGHscripts/render_harness.py1400 count=$(cat "$file" 2>/dev/null || echo 0)STRING
HIGHscripts/render_harness.py1497 count=$(cat "$file" 2>/dev/null || echo 0)STRING
HIGHscripts/render_harness.py1561count=$(cat "$state" 2>/dev/null || echo 0)STRING
HIGHscripts/render_harness.py1696 count=$(cat "$file" 2>/dev/null || echo 0)STRING
HIGHscripts/render_harness.py2133 ATTEMPT=$(cat "$KH_ROUTE_CURL_COUNT" 2>/dev/null || printf '0')STRING
HIGHscripts/render_harness.py2549 "IPv4 route probe tolerates retry": "ip -4 route get 172.31.1.1 2>/dev/null | route_dev || true",STRING
HIGHscripts/render_harness.py2550 "IPv6 route probe tolerates retry": "ip -6 route show default 2>/dev/null | route_dev || true",STRING
HIGHscripts/tests/test_kubernetes_channels.py50 'drain = false, disable_eviction = false, upgrade_window = null})}',CODE
Self-Referential Comments6 hits · 22 pts
SeverityFileLineSnippetContext
MEDIUM⚡locals.tf4041# Create the kube_hetzner_selinux.te file, that allows in SELinux to not interfere with various needed servicesCOMMENT
MEDIUM⚡locals.tf4051# Create the distribution-specific registries file before Kubernetes starts.COMMENT
MEDIUM⚡locals.tf4058# Create the distribution-specific kubelet config file if needed.COMMENT
MEDIUMinit.tf794 # This method is a stub which could be replaced by a more practical helm implementationCOMMENT
MEDIUMscripts/create.sh95# Create the folder if folder_name is providedCOMMENT
MEDIUMmodules/host/main.tf432# Creating the swap filesystemCOMMENT
Over-Commented Block20 hits · 20 pts
SeverityFileLineSnippetContext
LOWlocals.tf3981 exec /etc/cloud/rename_interface.shCOMMENT
LOW.pre-commit-config.yaml21# - '--args=--only=terraform_documented_outputs'COMMENT
LOWdocs/llms.md221 * `us-east`: Encompasses Ashburn, VA (`ash`).COMMENT
LOWdocs/llms.md361 server_type = "cx23",COMMENT
LOWdocs/llms.md621COMMENT
LOWdocs/llms.md761COMMENT
LOWdocs/llms.md781 # "node.kubernetes.io/role": "peak-workloads"COMMENT
LOWdocs/llms.md861 # The default is the official image from the Kubernetes project: registry.k8s.io/autoscaling/cluster-autoscalerCOMMENT
LOWdocs/llms.md921 #COMMENT
LOWdocs/llms.md981 # Cloudflare's R2 offers 10GB, 10 million reads and 1 million writes per month for free.COMMENT
LOWdocs/llms.md1521 * **Default:** `true` (for HA setups).COMMENT
LOWdocs/llms.md1741 # audiences:COMMENT
LOWdocs/llms.md1921 * `false`: Disables SELinux (likely sets it to permissive or fully disabled) on the nodes. This can make it easier tCOMMENT
LOWdocs/llms.md2281```terraformCOMMENT
LOWdocs/llms.md2341 * `audit_log_max_size`: Max size in MB before rotation (default: `100`)COMMENT
LOWdocs/llms.md2381 * **Recommendation:** Optional. If your services primarily use internal Kubernetes service discovery (e.g., `service-aCOMMENT
LOWdocs/llms.md2481```terraformCOMMENT
LOWdocs/llms.md3241 # Custom cert-manager valuesCOMMENT
LOWdocs/llms.md3261 # controller:COMMENT
LOWdocs/llms.md3301 # Custom Traefik valuesCOMMENT
Empty Error Handlers3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHscripts/contract_negative_tests.py244except FileNotFoundError:CODE
HIGHscripts/contract_negative_tests.py257except FileNotFoundError:CODE
HIGHscripts/tests/test_image_download.py34except (BrokenPipeError, ConnectionResetError):CODE
Unused Imports11 hits · 11 pts
SeverityFileLineSnippetContext
LOWscripts/sync_docs_site.py4CODE
LOWscripts/smoke_v3_plan_matrix.py9CODE
LOWscripts/validate_v3_final_polish_examples.py4CODE
LOWscripts/contract_negative_tests.py4CODE
LOWscripts/contract_negative_tests.py13CODE
LOWscripts/v2_to_v3_migration_assistant.py8CODE
LOWscripts/validate_tailscale_large_scale_examples.py13CODE
LOWscripts/validate_tailscale_large_scale_examples.py22CODE
LOWscripts/tests/test_migration_network_plan.py8CODE
LOWscripts/tests/reproduce_network_upgrade_plans.py10CODE
LOWscripts/tests/test_cilium_intake.py8CODE
Deep Nesting11 hits · 10 pts
SeverityFileLineSnippetContext
LOWscripts/sync_docs_site.py67CODE
LOWscripts/sync_docs_site.py135CODE
LOWscripts/sync_docs_site.py172CODE
LOWscripts/render_harness.py765CODE
LOWscripts/v2_to_v3_migration_assistant.py213CODE
LOWscripts/v2_to_v3_migration_assistant.py318CODE
LOWscripts/tests/test_kubernetes_channels.py57CODE
LOWscripts/tests/test_haproxy_proxy_protocol.py42CODE
LOWscripts/tests/test_haproxy_proxy_protocol.py118CODE
LOWscripts/tests/test_cilium_intake.py69CODE
LOWscripts/tests/test_image_download.py118CODE
Modern AI Meta-Vocabulary2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMdocs/terraform.md192| <a name="input_automatically_upgrade_os"></a> [automatically\_upgrade\_os](#input\_automatically\_upgrade\_os) | WhethCODE
MEDIUMdocs/terraform.md257| <a name="input_enable_kured"></a> [enable\_kured](#input\_enable\_kured) | Whether to include kured (the Kubernetes ReCODE
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippetContext
LOWlocals.tf389 # Check if the user has set custom DNS servers.COMMENT
LOWscripts/create.sh19# Check if terraform, packer and hcloud CLIs are presentCOMMENT