install-skills

SUSPICIOUS: the skill's purpose and SSH-based server actions are mostly coherent, but it installs and updates a bundle of additional skills through an insufficiently verified `hermes-setup` path. Main concern is transitive trust and unclear package provenance on the remote server, not overt exfiltration or confirmed malware.