hermai
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of its local CLI (
hermai) and MCP server (hermai-mcp) from the official 'hermai-ai' GitHub organization and npm registry. These downloads are documented as necessary components for local schema execution and session management. - [COMMAND_EXECUTION]: The documentation provides several shell commands for setup and use, including
curl,go install, andnpx. These commands are used to interact with the Hermai API and manage local tooling, with standard installation procedures such as moving binaries to system paths. - [DYNAMIC_EXECUTION]: The skill's architecture involves running JavaScript code provided in website schemas (signers and bootstrappers). This code is executed within a restricted 'goja' sandbox that lacks access to sensitive system primitives like the filesystem or arbitrary network requests, mitigating the risk of unauthorized execution.
Audit Metadata