Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real strategy-analysis skill, but it needs review because it can persist sensitive analysis files and install additional skills from the network without strong scoping or provenance controls.
Review this before installing if you work with sensitive company strategy data. Avoid running the initializer with --yes unless you intentionally want it to create local skill dependencies, and treat the generated PPT outline as a persisted copy of potentially confidential analysis.
if entry.is_dir() and (entry / "SKILL.md").exists():
installed.add(entry.name)
try:
result = subprocess.run(["hermes", "skills", "list"], capture_output=True, text=True, timeout=10)
for line in (result.stdout + result.stderr).split("\n"):
parts = [p.strip() for p in line.split("│")]
if len(parts) >= 2 and parts[1]:59/59 vendors flagged this skill as clean.
No suspicious patterns detected.