hermes-desktop-companion

SUSPICIOUS. The skill's broad capabilities mostly match a desktop companion for a powerful agent, but the install path is high-risk: unsigned binaries from a personal GitHub repo, RPM installs with --nogpgcheck, SmartScreen/quarantine bypass instructions, and temporary passwordless sudo. Data flows to many official third-party services are expected for this product class, and I found no direct credential exfiltration or hidden pre-execution malware behavior. Overall this looks more like a high-risk community desktop wrapper with weak install trust and transitive skill-loading risk than confirmed malicious content.