desktop-plugin-maker
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a meta-utility designed to guide developers in creating plugins for the Hermes Desktop application. It does not contain executable malicious code, obfuscation, or unauthorized data access patterns.
- [SAFE]: The skill explicitly promotes security best practices for plugin developers, including:
- Recommending the use of sandboxed iframes for presenting untrusted local HTML content to prevent access to Hermes APIs or the filesystem.
- Providing a checklist to scan exports for sensitive information like usernames, API tokens, and bearer headers before open-sourcing plugins.
- Enforcing namespaced storage and scoped network communication (
/api/plugins/<id>) to ensure isolation between plugins. - [SAFE]: All described filesystem operations (creating plugin files in
~/.hermes/desktop-plugins/) are standard for the targeted development environment and are clearly communicated to the user. - [SAFE]: The mentioned APIs (
host.request,ctx.rest,ctx.socket) are part of the platform's official SDK and are used for legitimate plugin functionality within the Hermes ecosystem.
Audit Metadata