skill-retrieval
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses
importlibandspec_from_file_locationin its__init__.pyto dynamically load its own internal scripts (bm25_retriever.pyandjev_rerank.py). This is a standard pattern for multi-file plugins in the Hermes Agent environment. - [DATA_EXFILTRATION]: When the optional
jevreranking feature is explicitly enabled by the user via environment variables, the skill sends truncated user queries and skill descriptions toapi.typesafe.aioropenrouter.ai. This behavior is documented as a core feature for semantic reranking and includes character caps to limit data exposure. - [COMMAND_EXECUTION]: The package's test suite (
tests/test_stdlib_parity.py) utilizessubprocess.runto verify that the runtime environment is free of specific heavy numeric dependencies. This operation is confined to the development and testing context and is not part of the skill's primary execution path. - [PROMPT_INJECTION]: The skill implements a
neutralize_queryfunction injev_rerank.pythat utilizes regex patterns to strip common imperative instruction-bypass phrases from user input before processing. This is a proactive security measure designed to mitigate prompt injection risks.
Audit Metadata