Is ask-dongfeng-agent safe to install?

SaferSkills independently audited ask-dongfeng-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md4.4 KB · Markdown

Ask DongFeng Agent

Ask DongFeng Agent is the integrated distribution path for Ask DongFeng.

It installs or verifies Hermes Agent, installs the Ask DongFeng skill, checks discovery, and launches Hermes Desktop when available.

Why This Repo Exists

ask-dongfeng is the lightweight skill repository.

ask-dongfeng-agent is the "fresh machine" path:

install Hermes Agent
install Ask DongFeng into the local Hermes skill tree
verify that Hermes can discover the skill
start Hermes CLI or Hermes Desktop GUI
keep the integration separate from Hermes core until a stable upstream path is justified

Current Status

This is an integration wrapper, not a Hermes fork.

The first useful version targets:

Windows native PowerShell
Windows + WSL2
macOS/Linux shell
Hermes Desktop via hermes desktop

Quick Start

Windows Native

Run PowerShell:

irm https://raw.githubusercontent.com/fengluisobel/ask-dongfeng-agent/main/scripts/install.ps1 | iex

Then test:

ask-dongfeng-agent-doctor
ask-dongfeng-agent-start

If the command shims are not on PATH, run from the cloned repo:

.\scripts\doctor.ps1
.\scripts\start.ps1

Windows Hermes installs have used both %USERPROFILE%\.hermes and %LOCALAPPDATA%\hermes depending on installer/version. The scripts honor HERMES_HOME first, then detect an existing %USERPROFILE%\.hermes, then fall back to %LOCALAPPDATA%\hermes.

Windows + WSL2

Run inside WSL:

curl -fsSL https://raw.githubusercontent.com/fengluisobel/ask-dongfeng-agent/main/scripts/install.sh | bash
ask-dongfeng-agent-doctor
ask-dongfeng-agent-start

macOS / Linux

curl -fsSL https://raw.githubusercontent.com/fengluisobel/ask-dongfeng-agent/main/scripts/install.sh | bash
ask-dongfeng-agent-doctor
ask-dongfeng-agent-start

What The Installer Does

Detects Hermes.
If Hermes is missing, runs the official Hermes installer.
Downloads or updates fengluisobel/ask-dongfeng.
Installs the skill into the local Hermes skill directory.
Runs a discovery check with hermes skills list --source local --enabled-only.
Adds small command shims:

ask-dongfeng-agent-doctor
ask-dongfeng-agent-start

Start The GUI

Ask DongFeng Agent does not reimplement chat UI.

It uses the upstream Hermes Desktop app:

hermes desktop

The wrapper command:

ask-dongfeng-agent-start

tries hermes desktop first, then falls back to:

hermes chat --skills ask-dongfeng

First Prompt

Use Ask DongFeng in intent-to-spec mode.

Goal:
Build an open-source Hermes skill that turns fuzzy product ideas into reviewable MVP specs.

Output:
A concise DongFeng Packet with boundary, decision, control artifact, execution contract, human gates, and next action.

Architecture

Ask DongFeng Agent
  -> official Hermes installer
  -> local Hermes runtime
  -> Ask DongFeng skill package
  -> Hermes CLI / Hermes Desktop

Read docs/architecture.md.

Windows Notes

Windows is supported through two paths:

Native Windows Hermes, installed under %LOCALAPPDATA%\hermes
WSL2 Hermes, installed under ~/.hermes

Native Windows is now supported by upstream Hermes, but shell quoting, path spaces, UTF-8 output, and GUI bootstrap are still common failure surfaces. The doctor script checks these explicitly.

Read docs/windows-native.md.

GUI Roadmap

The near-term GUI strategy is:

v0.1: launch upstream Hermes Desktop with Ask DongFeng installed
v0.2: add DongFeng prompt templates and example packets
v0.3: add a small launcher/onboarding UI if Hermes Desktop cannot expose enough entry points
v0.4: consider upstream PR or desktop extension points

Read docs/gui-roadmap.md.

Boundaries

This repo does not yet:

fork Hermes
modify Hermes core
ship a separate chat GUI
bundle model provider credentials
guarantee unattended long-task completion

Ask DongFeng improves control, drift detection, and review gates. It does not remove the need for human approval before irreversible or high-risk actions.

Development

git clone https://github.com/fengluisobel/ask-dongfeng-agent.git
cd ask-dongfeng-agent
bash -n scripts/install.sh scripts/doctor.sh scripts/start.sh
pwsh -NoProfile -File scripts/doctor.ps1 -CheckOnly

License

MIT

ask-dongfeng-agent— agent skill

Is ask-dongfeng-agent safe to install?

Ask DongFeng Agent

Why This Repo Exists

Current Status

Quick Start

Windows Native

Windows + WSL2

macOS / Linux

What The Installer Does

Start The GUI

First Prompt

Architecture

Windows Notes

GUI Roadmap

Boundaries

Development

License

Audit the pieces. Scan the whole. Decide.