setup-my-hermes-dashboard
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands on a remote VPS via SSH to set up the project directory, install binaries, and manage services. Evidence found in SKILL.md and scripts/dashboard.sh.
- [PRIVILEGE_ESCALATION]: Uses
sudoto install thedashboardscript to/usr/local/bin, manage systemd units in/etc/systemd/system/, and write configuration files to/etc/. Evidence found in scripts/dashboard.sh. - [EXTERNAL_DOWNLOADS]: Downloads project templates and scripts from the author's GitHub repository (
Melvynx/ai-maxxing-skills) and Node.js binaries from official distributions (nodejs.org). Evidence found in SKILL.md and scripts/dashboard.sh. - [PERSISTENCE]: Establishes a systemd service (
dashboard.service) on the VPS to maintain the dashboard process across restarts. It also instructs the agent to update other configuration files (~/.claude/rules/vps.md) to include dashboard-related rules. Evidence found in scripts/dashboard.sh and SKILL.md step 11. - [INDIRECT_PROMPT_INJECTION]: The skill sets up a pipeline for autonomous code generation based on user instructions.
- Ingestion points: User requests to add modules (template/AGENTS.md).
- Boundary markers: Absent; no specific instructions to ignore embedded commands in requested module descriptions.
- Capability inventory:
pnpm build,pnpm install, andsystemctl restart(scripts/dashboard.sh) allow the execution of newly generated code. - Sanitization: Absent; the system relies on the agent's ability to safely interpret and implement the request without filtering.
Audit Metadata