Security scanning and --force
All hub-installed skills go through a security scanner that checks for data exfiltration, prompt injection, destructive commands, supply-chain signals, and other threats. hermes skills inspect ... now also surfaces upstream metadata when available: repo URL skills.sh detail page URL install command weekly installs upstream security audit statuses well-known index/endpoint URLs Use --force when you have reviewed a third-party skill and want to override a non-dangerous policy block: Important behavior: --force can override policy blocks for caution/warn-style findings. --force does not override a dangerous scan verdict. Official optional skills ( official/... ) are treated as built-in trust and do not show the third-party warning panel.
From the official Hermes Agent documentation.
hermes skills install skills-sh/anthropics/skills/pdf --force