nemoclaw-contributor-update-hermes

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python utility collect-hermes-release-supplement.py executes Git commands to audit the repository state.\n
  • Evidence: subprocess.run calls at lines 217 and 273 in scripts/collect-hermes-release-supplement.py.\n
  • Context: The script includes extensive safety measures, such as validating that the Git executable is an absolute path outside the repository worktree and using a restricted environment to prevent configuration manipulation. This is consistent with secure development practices.\n- [EXTERNAL_DOWNLOADS]: The skill queries release metadata and tag information from GitHub APIs.\n
  • Evidence: gh api calls in SKILL.md targeting the NousResearch/hermes-agent repository.\n
  • Context: These operations are strictly for reconciling version history and are handled through official tools and APIs, matching the skill's stated purpose of dependency management.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 12:36 AM
Security Audit — agent-trust-hub — nemoclaw-contributor-update-hermes