skills/seaworld008/commonly-used-high-value-skills/hermes-graphify-gsd-project-integration/Gen Agent Trust Hub
hermes-graphify-gsd-project-integration
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the installation and upgrading of
graphifyy(via pip) andget-shit-done-cc(via npx) from standard package registries (PyPI and NPM) to ensure the global toolchain is available for repository integration. - [COMMAND_EXECUTION]: Uses shell scripts to perform repository management tasks, including git operations, file system checks, and the execution of tool-specific commands like
graphify updateandgsd-sdk. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by ingesting and acting upon data from repository files such as
AGENTS.md,README.md, and planning documents within the.planning/directory. Evidence includes ingestion points intemplates/ai-workflow.shwhich reads state and roadmap files without explicit sanitization beyond standard JSON parsing. - [PERSISTENCE_MECHANISMS]: Provides infrastructure for autonomous continuation by referencing the installation of cron jobs, allowing the agent to resume tasks across multiple sessions. This is implemented via templates like
templates/ai-workflow.shcalling external cron installation scripts.
Audit Metadata