hermes-feishu-streaming-card

SUSPICIOUS: The skill’s capabilities mostly fit its stated Feishu streaming-card purpose, and credential/data flows appear directionally appropriate. The main concern is install trust: the skill is presented as an ara.so Hermes skill while the referenced package/releases are published from a separate baileyh8 identity, and the optional manual GitHub release install increases supply-chain risk. No clear credential harvesting, covert exfiltration, or malicious pre-execution behavior is shown.