hermes-tweet
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill setup requires the installation of the
hermes-tweetPython package from a public registry to provide its core functionality. - [COMMAND_EXECUTION]: Installation instructions include executing commands to enable the plugin within the Hermes Agent runtime environment.
- [CREDENTIALS_UNSAFE]: The skill uses an
XQUIK_API_KEYto authenticate with X/Twitter APIs. It mitigates credential exposure by directing users to store the key in environment variables and explicitly advising against pasting it into prompts or tool inputs. - [PROMPT_INJECTION]: The skill is designed to ingest untrusted data from X/Twitter, which creates a surface for indirect prompt injection. This is addressed by instructions requiring explicit operator confirmation before the agent performs any account-changing actions based on external content.
Audit Metadata