external-skill-installation

SUSPICIOUS. The skill's stated purpose matches its behavior, but that behavior is intrinsically risky: it exists to install and import third-party skills into Hermes. The use of an official `skills` CLI lowers malware concern, yet the transitive trust chain, unpinned remote sources, and copying of external skill content into Hermes' trusted skills directory make this a high security-risk workflow.