Inspect a skill before installing and testing it

Before you start

• A disposable workspace and an identified skill source

Before installation

1. List candidates with the current Hermes skills CLI and inspect the exact skill files and source revision.
2. Identify shell commands, downloads, filesystem writes, model usage and account connections. Reject unexplained privileged commands.
3. Write one allowed task and one operation that must be denied. Use fake input and empty destinations.

Install, test, remove

Use the documented install command for the chosen source. Run only the allowed task and retain tool output plus file differences. Remove the skill using the current CLI, restart the session and check that it is no longer available. Do not assume removal reverses files or account changes already made by a skill.

hermes skills list --source hub
hermes skills --help

Success and failure criteria

Accept the trial only when the allowed task produces its expected artifact and the denied operation remains denied. A loaded skill name alone is insufficient. Unexpected network access, privilege requests or writes outside the test folder mean the trial needs review.

Evidence and limits

Official documentation checked

• Original BotClaw acceptance procedure based on linked official documentation. Product commands were not executed; check your installed version.

Sources

• https://hermes-agent.nousresearch.com/docs/user-guide/features/skills
• https://hermes-agent.nousresearch.com/docs/user-guide/security