hermes-dec-bytecode-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the 'hermes-dec' tool from several sources, including official package registries (PyPI, Snap, AUR) and its GitHub repository at
https://github.com/P1sec/hermes-dec.git. - [COMMAND_EXECUTION]: Contains Python and Bash scripts that utilize
subprocess.runand system utilities likeunzip,7z, andfindto extract and process local APK files and Hermes bytecode bundles. - [PRIVILEGE_ESCALATION]: Includes installation instructions using
sudo snap install, which is a standard procedure for installing software via the Snap package manager but involves administrative privileges. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it processes externally-sourced data from APK and bundle files.
- Ingestion points: The 'Batch Processing Script' and 'Full Analysis Pipeline' in
SKILL.mdingest untrusted files from the filesystem (e.g.,*.bundle,*.hbc). - Boundary markers: None are present; the skill processes file contents without explicit delimiters or instructions to ignore embedded malicious content.
- Capability inventory: The skill has the capability to execute shell commands and file system operations via
subprocess.run,unzip, and7zacross its example scripts. - Sanitization: The provided wrapper scripts do not implement explicit sanitization or validation of the input file contents before processing them with the disassembly tools.
Audit Metadata