hermespet-macos-ai-companion

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The set includes an unverified GitHub repo (basionwang-bot/HermesPet) which could distribute unsigned macOS builds if you clone/build or download releases, a generic/placeholder-looking API endpoint (your-gateway.com/v1) that could be attacker-controlled and used to exfiltrate keys or data, and an external site (ara.so) that should be validated — so these sources are potentially risky unless you verify the author, review the code/builds and confirm the gateway domain's trustworthiness.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's CustomAIService makes runtime HTTP requests to an environment-configured gateway (e.g., HERMES_GATEWAY_BASE_URL="https://your-gateway.com/v1") and POSTs to the /v1/chat/completions endpoint to retrieve model completions which directly control the agent's responses.