hermes-feishu-streaming-card

SUSPICIOUS: The skill's capabilities mostly match its stated Feishu streaming-card purpose, and data flows appear to stay local or go to official Feishu endpoints. The main concerns are supply-chain trust and installation power: unpinned pip install, mutable GitHub release download, and a personal-repo publisher whose installer patches Hermes runtime files. No clear credential harvesting, third-party proxying, or malicious exfiltration is evident from the provided content.