The vendored SKILL.md files were byte-identical to upstream, but the
playbooks, templates and schemas they reference were left behind in the
original repos, so a loading skill pointed at a file that does not exist
anywhere in this repository.
Vendored 1:1 into each skill directory (so they survive
`cp -r skills/* ~/.hermes/skills/`):
- plays/ for api-security-review, code-review-security, sca-audit,
secrets-scan, web-security-review (OWASP/secure-agent-playbook)
- templates/finding.md for the four OWASP skills that cite it
- schemas/finding.schema.json for cve-triage, patch-prioritization,
dependency-scanning (UnitOneAI/SecuritySkills)
- docs/sarif-output.md, docs/fixer-policy.md and
docs/normalized-json-output.md for dependency-scanning
Path fixes, the only edit to vendored text:
- the three UnitOneAI skills referenced ../../../schemas/ and ../../../docs/
which assumed upstream's skills/<category>/<skill>/ depth; this repo is
flat, so the links now resolve inside the skill directory
- safedeps told the agent to run <skill_dir>/../../check_deps.py while the
script is vendored next to SKILL.md; corrected to <skill_dir>/check_deps.py
and documented the script's exit codes (1 = finding, not a crash)
- NOTICE.md records the new files, the path edits, and the remaining known
gaps (hermaguard's kensei-pipeline references, the ASVS dataset citations,
and hermaguard being behind upstream)
Verified: every backticked path in every SKILL.md now resolves;
check_deps.py runs from the installed location and returns live OSV.dev
data ([email protected] -> 2 advisories); hermaguard's 46 tests still pass.
Evandro Fonseca Junior
bb3fe21766