Security checks across malware telemetry and agentic risk
This skill has a legitimate sharing purpose, but it automatically pushes skill archives to public file-sharing services and encourages one-step installation of received code into the agent’s active skills folder.
Use Review rather than outright blocking. Install only if you are comfortable sharing local skill contents with a temporary file host and installing received skills into the active Hermes environment. Before sharing, inspect the generated ZIP and avoid --all unless every skill is safe to disclose. Before installing a received ZIP, verify the sender, inspect install.sh and included SKILL.md files, and consider staging the files outside ~/.hermes/skills first.
2/66 vendors flagged this skill as malicious, and 64/66 flagged it as clean.
