Skills
Navigate
skills/nousresearch/hermes-agent/actual-setup/Gen Agent Trust Hub

actual-setup

Fail

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documentation includes a command to download and execute a shell script from a remote URL: curl -fsSL "https://actual.inc/install" | bash. While this is the official installation method for the service, executing remote scripts directly in a shell is a significant security risk.
  • [COMMAND_EXECUTION]: The skill uses various shell commands to configure the agent environment, such as hermes config set and actual models load. These commands modify local configuration and environment files like ~/.hermes/.env.
  • [EXTERNAL_DOWNLOADS]: The setup process involves downloading external model weights and metadata from actual.inc and other remote repositories.
  • [DATA_EXFILTRATION]: The skill instructions guide the agent to interact with sensitive files containing credentials, such as ~/.hermes/.env and ~/.local/share/opencode/auth.json.
Recommendations
  • HIGH: Downloads and executes remote code from: https://actual.inc/install - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 22, 2026, 03:31 AM
Security Audit — agent-trust-hub — actual-setup