hermes-skins-customization
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation directs users to clone a repository from a third-party GitHub user account:
https://github.com/joeynyc/hermes-skins.git. This source is not from a verified or trusted organization. - [REMOTE_CODE_EXECUTION]: Following the download, the skill instructs the user to run
python3 generate_screenshots.py. This executes code fetched from the external repository without prior verification or sandboxing. - [COMMAND_EXECUTION]: The skill uses shell commands to create directories, copy files, and modify local configuration files such as
~/.hermes/config.yaml. It also executes a Python command-line instruction to perform YAML validation on local files.
Recommendations
- AI detected serious security threats
Audit Metadata