hermes-dec-bytecode-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
hermes-decpackage from PyPI or via a git clone from the official repository athttps://github.com/P1sec/hermes-dec.git. - [COMMAND_EXECUTION]: The provided Python and shell scripts use
subprocess.runand standard CLI tools to execute disassembly and decompilation commands on user-provided bytecode files. - [PRIVILEGE_ESCALATION]: The installation guide includes
sudo snap install hermes-dec, which is a standard procedure for installing system-wide CLI tools on Linux environments. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data (APK and Hermes bytecode files) for analysis. While this represents an attack surface for parsing vulnerabilities, the skill follows standard reverse-engineering practices for static analysis.
- Ingestion points: Reads HBC files and APK archives via standard libraries (
zipfile) and CLI tools. - Boundary markers: None explicitly present in the provided scripts.
- Capability inventory: Uses
subprocess.runto call external analysis utilities andopen()to write analysis results to the file system. - Sanitization: Basic file integrity checks (magic number verification) are performed before processing.
Audit Metadata