Security audit
Hermes Tweet
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed X/Twitter integration that uses Xquik for reads and approval-gated account actions.
Install this only if you trust Xquik/Hermes with your X-related API access. Keep HERMES_TWEET_ENABLE_ACTIONS unset or false unless you intentionally need posting, deletion, following, webhooks, monitors, or other account-changing operations, and review the exact endpoint and payload before approving any action.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.