New solution skill
hcloud stores the API token in plaintext: lock down ~/.config/hcloud/cli.toml
Fixes hcloud leaking the API token through a world-readable config file. Use when setting up hcloud on shared machines or after copying cli.toml between hosts. The fix is chmod 600 on ~/.config/hcloud/cli.toml (and the directory). The token sits in plaintext; permissions are the only protection. Not for auth errors.