nemoclaw-contributor-update-hermes
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The Python utility
collect-hermes-release-supplement.pyexecutes Git commands to audit the repository state.\n - Evidence:
subprocess.runcalls at lines 217 and 273 inscripts/collect-hermes-release-supplement.py.\n - Context: The script includes extensive safety measures, such as validating that the Git executable is an absolute path outside the repository worktree and using a restricted environment to prevent configuration manipulation. This is consistent with secure development practices.\n- [EXTERNAL_DOWNLOADS]: The skill queries release metadata and tag information from GitHub APIs.\n
- Evidence:
gh apicalls inSKILL.mdtargeting theNousResearch/hermes-agentrepository.\n - Context: These operations are strictly for reconciling version history and are handled through official tools and APIs, matching the skill's stated purpose of dependency management.
Audit Metadata