hermes-graphify-gsd-nonintrusive-workflow

SUSPICIOUS: the skill’s behavior mostly matches its stated workflow-integration purpose, but it materially expands local automation through global installs, hooks, cron persistence, and optional external notification commands. The main concern is medium/high operational and supply-chain risk from unpinned latest installs and autonomous repo actions, not confirmed malware or obvious credential theft.

This file is best characterized as an automation orchestrator/dispatcher with a high-impact dynamic execution surface: it executes multiple helper scripts and an optional notifier using executable paths derived from environment/config variables. It also constructs file paths for markdown reads from a user-supplied name without visible sanitization, creating potential local file disclosure/traversal risk depending on how base directories are enforced. No direct evidence of malware/exfiltration is present within this snippet; the practical risk is supply-chain/compromise of config/env values or the delegated scripts/notifier, which would turn this wrapper into an arbitrary command execution conduit.

The fragment primarily writes a JSON payload to disk and prints all payload fields to stdout, both of which can impact confidentiality and integrity depending on payload contents. The highest supply-chain risk is the conditional execution of an external local shell script located relative to $ROOT, with output suppressed and errors ignored, which could enable hidden or unauthorized side effects. No definitive malicious behavior (exfiltration/backdoor/credential theft) is evidenced in the shown fragment alone, but the external script execution prevents a safe benign conclusion.

This file is primarily an artifact generator (JSON + Markdown) based on provided event metadata and local state/summary files. It does not show explicit data exfiltration or embedded malicious logic in the visible fragment. However, it contains a high-impact arbitrary command execution sink: it runs a command string from HERMES_AUTO_CONTINUE_NOTIFY_COMMAND via bash -lc, and it also sources configuration and invokes a secondary learning script with suppressed errors. Security depends on strict control of the sourced config, the environment variables (especially HERMES_AUTO_CONTINUE_NOTIFY_COMMAND), and the constraints on event/title/detail used in filenames and exported variables. If CI/environment variables can be tampered with, this becomes a straightforward RCE risk.

No direct malicious logic (no explicit data theft, shelling out to suspicious commands, or obfuscation) is present in this snippet. However, it performs high-impact supply-chain bootstrap actions: it installs/updates a Python package from an unpinned registry via pip, executes a locally resolved graphify binary after modifying PATH (creating a local execution risk if $HOME/.local/bin is compromised), and—most critically—downloads and executes an npm package via npx using a mutable @latest tag with no integrity verification. This should be treated as a significant supply-chain security risk and mitigated with pinned versions, lockfiles, and provenance/integrity checks.

No direct in-snippet malware behaviors (e.g., exfiltration, backdoors, credential theft) are visible; however, this bootstrap materially elevates supply-chain execution risk. It performs unpinned/upgrade-to-latest dependency installation in both Python (pip -U graphifyy) and npm (npx ...@latest get-shit-done-cc), then executes those fetched CLIs with global SDK/tooling installation flags. Additionally, the unusual package name and possible graphify vs graphifyy naming inconsistency warrant careful validation to reduce typosquatting/dependency confusion risk. For safer operation, use pinned versions, verify integrity (hashes/signatures), and avoid runtime @latest execution where feasible.