The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions in SKILL.md and the automated deployment script scripts/deploy.sh both utilize the curl | bash pattern to install the Hermes Agent. Specifically, it downloads a script from https://hermes-agent.nousresearch.com/install.sh and pipes it directly into the bash shell. This execution method is high-risk because it lacks integrity verification and executes remote code without prior inspection.
[CREDENTIALS_UNSAFE]: The scripts/deploy.sh script is designed to accept sensitive API keys (e.g., for DeepSeek, OpenAI, Anthropic) as positional command-line arguments. This practice is insecure as command-line arguments are typically recorded in the system's shell history files (such as ~/.bash_history) and can be viewed by other users on the system using process monitoring tools like ps or top.
[COMMAND_EXECUTION]: The skill performs remote command execution using SSH with the StrictHostKeyChecking=accept-new option enabled. This setting automatically accepts new host fingerprints and adds them to the user's known_hosts file without manual verification, which increases the risk of man-in-the-middle (MITM) attacks if the first connection occurs in an untrusted network environment.
[EXTERNAL_DOWNLOADS]: The skill fetches the Hermes Agent installation script from the official project domain at hermes-agent.nousresearch.com and provides instructions for cloning repositories from GitHub.

hermes-remote-deploy