Repository navigation
fix: the skill passes the Hermes Agent install scanner - #42
Merged
Merged
Conversation
Hermes skills-guard v10 rated the skill DANGEROUS on one line: the `echo "testo" | python3 scan.py -` example in SKILL.md (echo_pipe_exec, CRITICAL), and --force does not override a dangerous verdict. The stdin example in SKILL.md and the scan.py docstring is now a heredoc. lint_skill.py gains check_install_scanners with the Hermes rules. The clawhub.yml comments were in Russian and failed the repo's Cyrillic-free lint; translated. tools/skills_guard.py on a clean copy: SAFE, 0 findings. Same fix as ilyautov/humanizer-ru#161. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
ilyautov
added a commit
that referenced
this pull request
Oct 12, 2026
ci.yml existed only locally since June, so lint_skill, the tests and the eval harness never ran on PRs; lint_skill was broken on main unnoticed until #42. All steps pass locally on Python 3.11. eval/run_triggers.py read the root SKILL.md, which was removed (lint_skill forbids a root mirror); it now reads skills/humanizer-it/SKILL.md. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Installing the skill in Hermes Agent is blocked: the built-in skills-guard scanner (
tools/skills_guard.py, v10) rates it DANGEROUS, and--forcedoes not override that verdict for community skills. One finding:echo_pipe_exec(CRITICAL)SKILL.md:77,scan.pydocstringecho "testo" | python3 scan.py -→ heredocscan.py - <<'EOF'Same false positive as ilyautov/humanizer-ru#160, fixed there in ilyautov/humanizer-ru#161.
Also
lint_skill.py: newcheck_install_scannersgate with the Hermes rules (echo-pipe,!…``, barepip install, `\uXXXX` chains, literal invisible characters, ≤50 files).clawhub.yml: comments translated to English; they broke the repo's Cyrillic-free lint onmain.Verification
tools/skills_guard.pyfrom NousResearch/hermes-agent on a clean copy of the skill: was DANGEROUS, now SAFE, 0 findings.lint_skill,test_markers,test_score,test_package: green. The scanner reads stdin via heredoc as before.🤖 Generated with Claude Code