The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/open_workbench.py uses the subprocess.run function to execute a Node.js launcher. This is a standard implementation for starting secondary services required by the skill's primary functionality.
[CREDENTIALS_UNSAFE]: The skill manages several sensitive API keys (e.g., WORKBENCH_GATEWAY_API_KEY, API_SERVER_KEY) to enable platform integration. It retrieves these credentials from environment variables or local configuration files (~/.hermes/.env), following established patterns for secure secret management within the SenseNova ecosystem.
[DATA_EXFILTRATION]: The skill performs a network request using urllib.request.urlopen to validate the connectivity of the "Hermes Gateway." This request includes an API key in the Authorization header. This is a legitimate service-discovery and authentication step that targets local or configured platform endpoints.
[DYNAMIC_EXECUTION]: The script scripts/open_workbench.py dynamically locates the Node.js launcher (sensenova-ppt-workbench.mjs) by searching through a set of predefined local paths, including common development repositories. Once found, the script executes the launcher to initialize the workbench environment.
[EXTERNAL_DOWNLOADS]: The provided example HTML slides reference external CSS and font assets from Google Fonts (fonts.googleapis.com). These are well-known, trusted resources used for rendering and do not represent a security risk.

sn-ppt-workbench