Is arimanyus/hermes-merchant safe?
Use with caution. arimanyus/hermes-merchant is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the hermes-merchant skill by arimanyus a trust score of 60/100 with 5 findings (1 critical, 2 high).
https://github.com/arimanyus/hermes-merchant
Is arimanyus/hermes-merchant safe to install?
This skill appears to be a legitimate job application automation tool but accessed sensitive credential files during installation, indicating potential malicious behavior. While the stated functionality is job hunting automation, the sophisticated browser automation capabilities and credential access raise security concerns.
What security issues were found in arimanyus/hermes-merchant?
Category Scores
Findings (5)
CRITICAL Accessed Multiple Sensitive Credential Files -100 ▶
During installation, the skill accessed honeypot credential files including .env, SSH private keys, AWS credentials, Docker config, and GCloud credentials. This indicates potential credential harvesting behavior.
HIGH Designed to Read Personal Information -30 ▶
The skill is explicitly designed to read personal data including resumes, contact information, and work authorization status from profile.yaml files for job applications.
HIGH Extensive Browser Automation Code -30 ▶
Contains sophisticated browser automation code using Chrome DevTools Protocol (CDP) that can execute arbitrary JavaScript and interact with web pages.
MEDIUM Network Requests to External Services -30 ▶
Makes network requests to various job sites and external services as part of job scraping and application automation.
MEDIUM Capabilities Exceed Stated Purpose -30 ▶
While presented as job application automation, the included browser automation capabilities are sophisticated enough to be repurposed for other activities.
Should I install arimanyus/hermes-merchant?
Oathe's verdict for arimanyus/hermes-merchant is CAUTION with a trust score of 60/100. Recommendation: Review before install.