hatch
Hatch provisions cloud VMs for development, enabling project creation, feature branching, and deployment with GitHub, Vercel, and Convex integration.
Install this skill
Security score
The hatch skill was audited on Feb 27, 2026 and we found 50 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 12 | Hatch is installed at `~/.hatch-cli`. All commands must be run from that directory using `pnpm dev`. |
Access to hidden dotfiles in home directory
| 18 | cd ~/.hatch-cli && pnpm dev list --json |
Access to hidden dotfiles in home directory
| 24 | cd ~/.hatch-cli && pnpm dev status --json |
Access to hidden dotfiles in home directory
| 37 | cd ~/.hatch-cli && pnpm dev new <project-name> --dry-run |
Access to hidden dotfiles in home directory
| 38 | cd ~/.hatch-cli && pnpm dev new <project-name> --confirm <token> |
Access to hidden dotfiles in home directory
| 50 | cd ~/.hatch-cli && pnpm dev feature <name> --project <project> --dry-run |
Access to hidden dotfiles in home directory
| 51 | cd ~/.hatch-cli && pnpm dev feature <name> --project <project> --confirm <token> |
Access to hidden dotfiles in home directory
| 63 | cd ~/.hatch-cli && pnpm dev spike <name> --project <project> --prompt "<instructions>" --dry-run |
Access to hidden dotfiles in home directory
| 64 | cd ~/.hatch-cli && pnpm dev spike <name> --project <project> --prompt "<instructions>" --confirm <token> |
Access to hidden dotfiles in home directory
| 78 | cd ~/.hatch-cli && pnpm dev progress <feature> --project <project> |
Access to hidden dotfiles in home directory
| 89 | cd ~/.hatch-cli && pnpm dev clean <name> --project <project> --dry-run |
Access to hidden dotfiles in home directory
| 90 | cd ~/.hatch-cli && pnpm dev clean <name> --project <project> --confirm <token> |
Access to hidden dotfiles in home directory
| 101 | cd ~/.hatch-cli && pnpm dev add <project-name> |
Access to hidden dotfiles in home directory
| 107 | cd ~/.hatch-cli && pnpm dev clone --project <name> [--path <dir>] [--pull] [--json] |
Access to hidden dotfiles in home directory
| 113 | cd ~/.hatch-cli && pnpm dev connect |
Access to hidden dotfiles in home directory
| 119 | cd ~/.hatch-cli && pnpm dev config |
Access to hidden dotfiles in home directory
| 126 | - `--project <name>` - Create per-project config at `~/.hatch/configs/<name>.json` |
Access to hidden dotfiles in home directory
| 130 | Per-project configs live at `~/.hatch/configs/<project-name>.json`. Commands with `--project` auto-resolve the right config. |
Access to hidden dotfiles in home directory
| 134 | cd ~/.hatch-cli && pnpm dev config --project my-app |
Access to hidden dotfiles in home directory
| 137 | cd ~/.hatch-cli && pnpm dev config list --json |
Access to hidden dotfiles in home directory
| 140 | cd ~/.hatch-cli && pnpm dev config check --project my-app --json |
Access to hidden dotfiles in home directory
| 143 | cd ~/.hatch-cli && pnpm dev config-push <ssh-host> --project my-app |
Access to hidden dotfiles in home directory
| 146 | When `--project` is provided on feature/spike/clean commands, the matching config is used automatically. Falls back to `~/.hatch.json` if no project-specific config exists. |
Access to hidden dotfiles in home directory
| 150 | cd ~/.hatch-cli && pnpm dev update |
Access to hidden dotfiles in home directory
| 208 | cd ~/.hatch-cli && pnpm dev list --json |
Access to hidden dotfiles in home directory
| 216 | cd ~/.hatch-cli && pnpm dev spike <feature> --project <project> --continue <vm-name> --prompt "additional changes" |
Access to hidden dotfiles in home directory
| 280 | Generated projects include structured logging. In development, the server logger writes JSON log entries to `~/.harness/logs/app.jsonl` on the VM. |
Access to hidden dotfiles in home directory
| 327 | - Which project and config will be used (`~/.hatch/configs/<name>.json` or `~/.hatch.json`) |
Access to hidden dotfiles in home directory
| 336 | - **Cross-check project names**: The `--project` value must match both the project name in `hatch list` and the config filename in `~/.hatch/configs/`. Mismatches mean wrong credentials. |
Access to hidden dotfiles in home directory
| 346 | cd ~/.hatch-cli && pnpm dev config list --json |
Access to hidden dotfiles in home directory
| 348 | # 2. Show the human: "I'll create project 'my-app' using config ~/.hatch/configs/my-app.json |
Access to hidden dotfiles in home directory
| 352 | cd ~/.hatch-cli && pnpm dev new my-app --dry-run |
Access to hidden dotfiles in home directory
| 355 | cd ~/.hatch-cli && pnpm dev new my-app --confirm <token> |
Access to hidden dotfiles in home directory
| 362 | cd ~/.hatch-cli && pnpm dev list --json |
Access to hidden dotfiles in home directory
| 363 | cd ~/.hatch-cli && pnpm dev config check --project my-app --json |
Access to hidden dotfiles in home directory
| 366 | # using config ~/.hatch/configs/my-app.json (GitHub: org/my-app, Convex: my-app). |
Access to hidden dotfiles in home directory
| 370 | cd ~/.hatch-cli && pnpm dev feature my-feature --project my-app --dry-run |
Access to hidden dotfiles in home directory
| 373 | cd ~/.hatch-cli && pnpm dev feature my-feature --project my-app --confirm <token> |
Access to hidden dotfiles in home directory
| 380 | cd ~/.hatch-cli && pnpm dev list --json |
Access to hidden dotfiles in home directory
| 381 | cd ~/.hatch-cli && pnpm dev config check --project my-app --json |
Access to hidden dotfiles in home directory
| 384 | # using config ~/.hatch/configs/my-app.json. |
Access to hidden dotfiles in home directory
| 389 | cd ~/.hatch-cli && pnpm dev spike my-feature --project my-app --prompt "Add contact form" --dry-run |
Access to hidden dotfiles in home directory
| 409 | cd ~/.hatch-cli && pnpm dev spike my-feature --project my-app --prompt "<final approved prompt>" --confirm <token> |
Access to hidden dotfiles in home directory
| 412 | cd ~/.hatch-cli && pnpm dev status --project my-app --json |
Access to hidden dotfiles in home directory
| 421 | cd ~/.hatch-cli && pnpm dev clean my-feature --project my-app --dry-run |
Access to hidden dotfiles in home directory
| 422 | cd ~/.hatch-cli && pnpm dev clean my-feature --project my-app --confirm <token> |
Access to hidden dotfiles in home directory
| 428 | cd ~/.hatch-cli && pnpm dev spike my-feature --project my-app --prompt "Add contact form" --wait --json |
Access to hidden dotfiles in home directory
| 434 | Spikes use the `anthropicApiKey` from the project config (`~/.hatch/configs/<name>.json`). The key is injected inline via the SSH command — it is not written to the VM environment, so interactive `cla |
Access to hidden dotfiles in home directory
| 442 | 4. Or clean up with `cd ~/.hatch-cli && pnpm dev clean` and try again |
Access to hidden dotfiles in home directory
| 447 | - For auth failures: update `anthropicApiKey` in the project config (`~/.hatch/configs/<name>.json`) and retry |