{"id":"cmt8pr2av1686ad09ektq2kgf","slug":"github-repo-management","publicId":"0b03ef13-ef58-4403-bbc4-300d80101ac9","name":"github-repo-management","description":"Clone/create/fork repos; manage remotes, releases.","version":"1.1.0","author":"Hermes Agent","license":"MIT","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":9,"fileCount":2,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/NousResearch/hermes-agent/tree/main/skills/github/github-repo-management","createdAt":"2026-08-25T13:41:20.358Z","completedAt":"2026-08-25T13:41:20.282Z","visibility":"public","publishedAt":"2026-07-29T11:29:39.923Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 2 hard fails in security or structure checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":"fail"},{"source":"cisco","weight":0.8,"verdict":"pass"}],"consensus":"fail","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":["SSH private key file access","Credential access followed by network transmission"]},"verdictPolicyVersion":"consensus-v1","skillId":"cms605q9z03pwad0h79lokc1m","findings":[{"id":"cmt8pr2ax168nad09i3k6n6dj","source":"vettd","category":"security","label":"Credential access followed by network transmission","detail":"SKILL.md reads a credential source and transmits data over the network. Common exfiltration pattern.","severity":"critical","ruleId":"VTD-0089","owaspLlmCategory":null,"intent":"malicious","chainId":"cred-exfil-0","fingerprint":"781808e14bc87789869de594b65ff231","filepath":"SKILL.md"},{"id":"cmt8pr2ax168jad09eu3vys86","source":"vettd","category":"security","label":"SSH private key file access","detail":"Detected in SKILL.md:308 — `gh secret set SSH_KEY < ~/.ssh/id_rsa`","severity":"critical","ruleId":"VTD-0006","owaspLlmCategory":null,"intent":"malicious","chainId":"cred-exfil-0","fingerprint":"f6a5d2680f578fcce2feba0bb2995cc5","filepath":"SKILL.md"},{"id":"cmt8pr2ax168mad0950sy0thq","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmt8pr2ax168oad09x58r3q1n","source":"cisco","category":"security","label":"TOOL CHAINING ABUSE detected by YARA","detail":"SKILL.md:295 — Detects suspicious tool chaining patterns that could lead to data exfiltration: .ssh/id_rsa\ngh secret list\ngh secret delete API_KEY\n```\n\n**With curl","severity":"medium","ruleId":"YARA_tool_chaining_abuse_generic","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"55909f3dfed6a0c79c53f0ea869149a7","filepath":"SKILL.md"},{"id":"cmt8pr2ax168pad09dkguneoo","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/github-api-cheatsheet.md:24 — Pipeline downloads data from the network and executes it: `curl -s ... | python3 -c \"import sys,json; data=json.load(sys.stdin); print(data['field'])\"`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"540c1e0a6925c1a3b590900929593831","filepath":"references/github-api-cheatsheet.md"},{"id":"cmt8pr2ax168lad09oz16hu8w","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmt8pr2aw168cad09v4dky9jn","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmt8pr2ax168kad09704i7k1i","source":"vettd","category":"security","label":"No secrets or unsafe code patterns detected","detail":"Scanned all files for credentials, private keys, and code-level risks (eval, shell exec, destructive ops)","severity":"info","ruleId":"VTD-0091","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2e3428ecd3c04cac33cabd959f51437a","filepath":""},{"id":"cmt8pr2aw1688ad09ataguch0","source":"vettd","category":"structure","label":"No scripts/ directory","detail":"Consider bundling reusable scripts for validation and automation","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmt8pr2aw1689ad0921lbkz9f","source":"vettd","category":"structure","label":"references/ directory present","detail":"Additional documentation files available for progressive disclosure","severity":"info","ruleId":"VTD-0097","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a5f22b7185c58877c3d5a94338930d62","filepath":""},{"id":"cmt8pr2aw1687ad09jx4ybuul","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmt8pr2aw168bad09o97t5lod","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"github-repo-management\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmt8pr2aw168ead092uzxiram","source":"vettd","category":"description","label":"Description lacks usage context","detail":"Add context like \"Use this skill when...\" to help agents know when to activate it","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cmt8pr2aw168dad098p4xeak1","source":"vettd","category":"description","label":"Description within character limit","detail":"50/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cmt8pr2ax168gad09sz48dw1y","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmt8pr2ax168had09zmv2xsk0","source":"vettd","category":"best-practices","label":"No clear workflow structure","detail":"Consider adding numbered steps or a structured procedure for the agent to follow","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmt8pr2ax168iad09hvhvnxgz","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmt8pr2aw168fad09jkx8ghqq","source":"vettd","category":"best-practices","label":"SKILL.md exceeds 500 lines","detail":"504 lines — consider moving detailed reference material to references/","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmt8pr2aw168aad09hf1lagsb","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"B","findingCount":2,"criticalCount":0,"highCount":0},{"source":"vettd","status":"success","verdict":null,"grade":"F","findingCount":17,"criticalCount":2,"highCount":2}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"NousResearch","name":"hermes-agent"},"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T11:28:39.340Z","lastVerifiedAt":"2026-08-29T12:15:13.578Z","lastChangeDetectedAt":"2026-08-12T12:52:46.835Z","scannedHash":"c14c0f9f520f12f1be6c6143c5178cc41fa1f142","latestUpstreamHash":"c14c0f9f520f12f1be6c6143c5178cc41fa1f142","nextCheckDueAt":"2026-10-28T11:28:39.340Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":25,"publisherSupplied":["name","description","author","version","license"]}