skills/wshobson/agents/hermes-tweet/Gen Agent Trust Hub

hermes-tweet

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill setup requires the installation of the hermes-tweet Python package from a public registry to provide its core functionality.
  • [COMMAND_EXECUTION]: Installation instructions include executing commands to enable the plugin within the Hermes Agent runtime environment.
  • [CREDENTIALS_UNSAFE]: The skill uses an XQUIK_API_KEY to authenticate with X/Twitter APIs. It mitigates credential exposure by directing users to store the key in environment variables and explicitly advising against pasting it into prompts or tool inputs.
  • [PROMPT_INJECTION]: The skill is designed to ingest untrusted data from X/Twitter, which creates a surface for indirect prompt injection. This is addressed by instructions requiring explicit operator confirmation before the agent performs any account-changing actions based on external content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 03:47 PM
Security Audit — agent-trust-hub — hermes-tweet