What problem does it solve? Installing a downloaded third-party skill package into a Hermes profile is not a per-skill registration task — it is a filesystem copy that must respect the loader's recursive discovery rules, and third-party packs often ship embedded instruction chains that must be treated as untrusted data rather than executed. ## Core Features & Use Cases - Bulk package import: Copies an entire pack tree (SKILL.md files plus scripts/, references/, config/) wholesale under a profile category directory so nested modules are discovered automatically. - Loader-aware layout: Applies verified discovery rules from agent/skill_utils.py — any directory containing SKILL.md is a skill root at any nesting depth, and skills_list re-scans the filesystem live. - Supply-chain vetting: Flags embedded instruction chains in downloaded packs (precedent-auth files, auto-bootstrap scripts, routing contracts) as untrusted data and refuses to auto-execute them. - Use Case: A user downloads an 85-skill security pack and asks to load it; the skill inspects frontmatter, checks name conflicts, copies the tree under skills/reverse-skill/, patches broken cross-tree references, verifies with skills_list, and reports what was deliberately not run. ## Quick Start Install this downloaded skill package into my Hermes profile and verify the new skills are discoverable.
