hermes-onboarding

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill executes npm install -g donsetch from an arbitrary public registry URL and clones or installs from external third-party GitHub repositories (moonlight-lupin/agent-skills), which constitutes an unofficial operational dependency.