llmquant-setup
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches authoritative setup documentation and playbooks from the vendor's official GitHub repository (
LLMQuant/llmquant-hermes). These resources are used to ensure the agent's configuration matches the most current requirements. - [COMMAND_EXECUTION]: Utilizes the
hermesCLI to perform version checks, manage MCP server configurations, and install additional vendor skills (hermes skills tap add). These operations are consistent with the skill's stated purpose of environment initialization. - [DATA_EXPOSURE_AND_EXFILTRATION]: Accesses the agent's configuration file (
~/.hermes/config.yaml) to add necessary service endpoints. The skill explicitly directs the agent to back up the configuration before editing and includes instructions to avoid echoing secrets to the user. - [PERSISTENCE]: Instructs the agent to schedule standing jobs using the
hermes croncommand. This is a standard functional requirement for the intended use case of monitoring data playbooks. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from an external Markdown file (
SETUP.md). While this creates an ingestion point for external instructions, the risk is mitigated as the source is the official repository controlled by the skill's author.
Audit Metadata