Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently manages explicitly requested background tasks, with disclosed installation and approval controls, though its separate runtime was unavailable for inspection.
Use a reviewed, pinned CLI release and treat npx help as executing package code. Review the installation plan, worker permissions and model budget before enabling persistent operation. Keep the dashboard local unless Tailnet access is intended and restricted. This review covers the bundled instructions, not the external runtime or its claimed security enforcement.
The supplied code is a help invocation, not an implementation of the declared workflow. The package name suggests a relationship to the stated purpose, but does not establish that this command performs the promised behavior. Package retrieval is not independently treated as a mismatch, and the package's internal behavior cannot be determined from this snippet.
The unpinned npx command can download and execute a changing npm release with the agent's host privileges, exposing the host to a compromised or malicious package release. Calling it a 'read-only invocation' is misleading: requesting --help does not prevent package installation or arbitrary initialization code from running. Although this is a CLI rather than an MCP server, the underlying supply-chain concern is valid; the global and source installation examples have similar reproducibility weaknesses.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
The core CLI is platform-neutral, but Hermes conversation routing requires its own dispatcher and notifier. Generate a plan and verify its installation confirmation summary identifies Hermes, the absolute Hermes CLI path, intended workspace and queue, systemd scheduler, source-bound notification routing, and writes enabled: no (plan only). If any field identifies the wrong platform or destination, stop. Confirm installation only after that review, then run the read-only doctor and disposable smoke:
loop-engineering-hermes-install \