docker-setup

Sends data to these websites: github.com, bun.sh, storage.googleapis.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 9 places.

• plugins/hermitd/skills/docker-setup/SKILL.md, line 2608b. **Public-repo pre-flight (for every non-`claude-plugins-official` entry that the operator has tentatively confirmed in steps 7 or 8).** From the host, run a
• plugins/hermitd/docs/creating-your-own-hermit.md, line 46disallowedTools: [WebSearch, WebFetch]
• plugins/hermitd/scripts/channel-bot-id.ts, line 60const resp = await fetch(probe.url, { headers: probe.headers, signal: AbortSignal.timeout(TIMEOUT_MS) });

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 69 places.

• plugins/hermitd/skills/docker-setup/SKILL.md, line 316bun ${CLAUDE_PLUGIN_ROOT}/scripts/render-docker-templates.ts <PROJECT_ROOT> <<'HERMIT_RENDER_JSON'
• plugins/hermitd/skills/docker-setup/SKILL.md, line 337echo '<the manifest_seed object only: {"plugin_version":...,"entries":[...]}>' | bun ${CLAUDE_PLUGIN_ROOT}/scripts/manifest-seed.ts <PROJECT_ROOT>/.hermit
• plugins/hermitd/skills/docker-setup/SKILL.md, line 372.hermit/bin/hermitd-run hermitd-cli install

and 49 more places

Downloads and installs other software

The author does not mention this.

Found in 9 places.

• plugins/hermitd/docs/creating-your-own-hermit.md, line 106npx skills@latest add OWNER/SKILLS-REPO --agent claude-code
• plugins/hermitd/docs/creating-your-own-hermit.md, line 107npx skills@latest add ./my-personal-skills --agent claude-code
• plugins/hermitd/docs/security.md, line 43"Bash(curl * | bash*)",

Can call paid AI services billed to you

The author does not mention this.

Found in 3 places.

• plugins/hermitd/docs/docker-security.md, line 85getent hosts api.anthropic.com >/dev/null && echo "allow OK"
• plugins/hermitd/docs/security.md, line 285A present `GROQ_API_KEY` or `OPENAI_API_KEY` enables uploading audio when local transcription is unavailable, with Groq tried first. No key means no cloud uploa
• plugins/hermitd/docs/security.md, line 392- **Network:** allow only `api.anthropic.com`, your channel API, and `github.com` when possible

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 3 places.

• plugins/hermitd/docs/security.md, line 50"Bash(cat ~/.ssh/*)",
• plugins/hermitd/docs/security.md, line 51"Bash(cat ~/.aws/*)",
• plugins/hermitd/scripts/lib/backup.ts, line 228try { content = fs.readFileSync(path.join(root, '.env'), 'utf-8'); } catch { return null; }

Changes files outside its own folder

This is disclosed by the author in the skill's SKILL.md or README.

Found in 4 places.

• plugins/hermitd/scripts/render-docker-templates.ts, line 105" printf '%s\\n' '#!/bin/sh' 'if [ ! -f \"${HERMIT_PLUGIN_ROOT:-}/scripts/browser-agent.ts\" ]; then echo \"agent-browser: hermit plugin unavailable\" >&2; e
• plugins/hermitd/scripts/render-docker-templates.ts, line 107' mkdir -p /etc/hermit && touch /etc/hermit/managed-browser',
• plugins/hermitd/scripts/render-docker-templates.ts, line 113.replace('touch /etc/hermit/managed-browser', "printf 'display=plugin\\n' > /etc/hermit/managed-browser; " + '\\' + '\n fi\n# --- end managed browser ---');