setup-my-hermes-dashboard

SUSPICIOUS: the skill's capabilities mostly match its stated purpose, but it has medium trust risk because it clones mutable code from GitHub, installs server-side executables, creates a privileged dashboard key, and installs additional agent skills/rules. Data flows are largely coherent and stay within the user's VPS/GitHub/Hermes setup, so this is not confirmed malware, but it is more powerful than a minimal dashboard setup helper.

SUSPICIOUS. The skill’s capabilities broadly match its purpose of maintaining a personal dashboard, and its data flows appear local/owner-controlled. The main concern is install and execution trust: it relies on opaque custom CLIs (`dashboard`, `dashboard-cli`) whose provenance could not be verified, and one of them handles API keys and deployment actions. That makes the skill high-risk from a supply-chain perspective even though there is no clear evidence of malicious intent or credential exfiltration.