hermes-edu-skills
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands such as
npm install -gandnpxto perform software installation and configuration updates.- [EXTERNAL_DOWNLOADS]: The skill requires downloading a third-party package (hermes-edu-skills) from the npm registry, which is not managed by a recognized trusted organization and is external to the author's infrastructure.- [REMOTE_CODE_EXECUTION]: The package installation commands result in the execution of code from an unverified remote source, posing a risk of system compromise.- [PERSISTENCE]: The installation process modifies the agent's~/.hermes/config.yamlconfiguration to add persistent paths for external skills, ensuring the third-party code is loaded in all subsequent sessions.
Recommendations
- AI detected serious security threats
Audit Metadata