hermoso-research
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y hermosoto download the vendor's CLI tool from the NPM registry as its primary execution method. - [COMMAND_EXECUTION]: Executes various
hermosoCLI subcommands (e.g.,competitors,ads pull,research) via theBashtool to perform research tasks. - [REMOTE_CODE_EXECUTION]: The use of
npx -y hermosoinvolves fetching and executing code from a remote registry at runtime. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves external ad copy, hooks, and marketing content from third-party platforms including Meta, Google, LinkedIn, and TikTok via CLI commands in
SKILL.md. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the retrieved advertising data.
- Capability inventory: The skill has the capability to execute shell commands and perform network-based research tasks across its primary functions.
- Sanitization: The instructions do not specify any sanitization or validation of the external content retrieved from ad libraries before processing.
Audit Metadata