The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and consolidate content from other Hermes skills, creating a surface where untrusted data (the target skills) is ingested into the agent context. The skill explicitly mitigates this by instructing the agent to treat all inspected content as untrusted evidence rather than instructions, requiring a separate read-only analysis phase, and mandating explicit user approval before any changes are applied.
[COMMAND_EXECUTION]: The skill includes Python helper scripts (scripts/snapshot_skills.py and scripts/validate_bundle.py) for managing local backups and verifying bundle integrity. These scripts are limited to the Python standard library and perform local filesystem operations such as copying files and calculating hashes, with built-in checks to ensure backups are stored outside the live skills tree.
[DYNAMIC_EXECUTION]: The test suite (tests/test_snapshot.py) uses standard Python module loading techniques to execute the local snapshot script for verification purposes. This is restricted to local files included within the skill bundle and is used for unit testing.
[DATA_EXPOSURE]: The skill interacts with local skill directories and configuration files. It includes a validation script that audits the skill's own content for hardcoded secrets or private environment markers before distribution, promoting secure development practices.

hermes-skill-consolidate