setup-vps

SUSPICIOUS: the skill is coherent with its purpose, but that purpose is inherently high-trust and broad. It forwards the user's GitHub and Cloudflare credentials to a VPS, copies Cloudflare secrets into Hermes env files, enables autonomous actions without approvals, and depends partly on raw GitHub/personal-repo file fetches plus missing installer code that cannot be verified here. Not confirmed malware, but high security risk and disproportionate trust requirements.

SUSPICIOUS. The skill's deployment and GitHub actions broadly match its stated dashboard-setup purpose, but its install path is high-risk: it copies executable scripts from an unpinned mutable GitHub checkout into /usr/local/bin with sudo, and it chains into another skill install. I do not see confirmed credential theft or covert exfiltration, so this is not malware, but the supply-chain and transitive-trust risks make it unsafe to treat as benign.

SUSPICIOUS: the core GitHub/Cloudflare/publishing purpose is coherent, and gh/cf align with that purpose, but the skill grants an agent broad access to already-authenticated admin tools on a 24/7 owner server, reads raw Cloudflare credentials from a local file, and includes transitive skill installation via an only partially verifiable `hermes-setup` command. No direct exfiltration or overt malware is shown, but the privilege level and trust chain are broader than a simple helper skill.

SUSPICIOUS. The stated purpose matches a skill manager, but it installs other skills through an unverifiable local tool and cache without clear publisher proof, pinning, or release verification. The transitive installation behavior materially increases risk because future skills inherit agent permissions, even though no direct credential theft or exfiltration is shown here.

This is setup documentation rather than executable code and contains no direct evidence of malware. It describes storing API and bot credentials in ~/.hermes/.env, using Claude credentials from ~/.claude/.credentials.json, and sending client IP information to ip-api[.]com. Its main security concern is an option that disables command approvals and permits edits to protected instruction files, making agent misuse potentially impactful; the documented allowlists and localhost-only dashboard are mitigating controls. Severity is moderate configuration risk, not demonstrated malicious behavior.