hermesone
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to install the
hermesonepackage globally vianpm install -g hermesone@0.2.0and execute management commands likehermesone installandhermesone update. - [REMOTE_CODE_EXECUTION]: The core functionality involves downloading and running native platform-specific binaries (macOS .zip, Windows .exe, Linux .AppImage) from the
fathah/hermes-desktopGitHub repository. - [EXTERNAL_DOWNLOADS]: Fetches application assets and manifest files containing SHA512 checksums from GitHub releases during the installation and update processes.
- [SAFE]: The skill implements strong security practices: it enforces a fail-closed SHA512 verification check for all downloads and requires explicit user approval before modifying the host system. It also provides a
plancommand for users to audit the installation details before proceeding.
Audit Metadata