Install this skill
or
90/100
Security score
The revenue-ledger skill was audited on Oct 21, 2026 and we found 2 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
medium line 13
Access to home directory dotfiles
SourceSKILL.md
| 11 | compatibility: >- |
| 12 | Requires Python 3.8+ (standard library only). |
| 13 | Stores a plain JSON ledger under ~/.hermes/state/. |
| 14 | No network access. |
| 15 | metadata: |
medium line 151
Access to home directory dotfiles
SourceSKILL.md
| 149 | ## Storage |
| 150 | |
| 151 | `~/.hermes/state/bounty_ledger.json` by default, overridable with |
| 152 | `LEDGER_PATH`. Writes are atomic (temp file plus rename) so a crash mid-write |
| 153 | cannot corrupt the file. The ledger is plain JSON — readable, diffable, and |
Scanned on Oct 21, 2026
View Security Dashboard