hermes-integration

SUSPICIOUS: The skill is broadly consistent with Hermes integration, and the upstream project appears legitimate, but it grants a wide, credential-bearing MCP/CLI layer the ability to read conversations and autonomously send messages or run scheduled tasks. Main concerns are broad scope, versionless external-tool trust, and autonomous cross-platform actions rather than clear malware or credential theft.