hermes-edu-skills

SUSPICIOUS. The skill is broadly coherent with its stated purpose as an education skill-pack installer, and there is no clear credential theft, exfiltration, pre-execution payload, or malicious data-routing pattern. However, it performs transitive installation into multiple agent ecosystems and has unresolved provenance inconsistencies between the claimed publishers and the referenced repo ownership, so trust is weaker than a clearly same-org official package.