The SKILL.md says what it helps with, what it refuses to cover, and who should use it.
Skill Trust Bureau · v0 method
We audit agent skills for the failures that hurt real operators.
Hermosskills does not sell a magic “safe forever” stamp. We publish a small, dated review method: what the skill does, where it can break, how it handles secrets, and when a human must stop the agent.
What “Audited v0” means
The skill must keep live keys, tokens, and passwords out of chat, logs, and copied examples.
Money movement, outbound messages, public posts, and deploys require explicit human approval.
Risky steps include a stop point, rollback note, or verification command before the user proceeds.
The page links to the skill, catalog JSON, and a dated review stamp. No hidden logos or invented customers.
Audited v0 is not a penetration test, SOC 2 report, legal advice, or malware guarantee.
Public ledger
First audit candidate
The first public writeup is intentionally narrow: Stripe go-live operations for small products. Pete still owns the final pass/fail verdict before Hermosskills counts it toward the three-audited-skills target.
Skill
Status
Reason it matters
Candidate review prepared
Payment launches are where secret handling, human gates, and rollback discipline matter first.
Current business metric: 0 paid sponsors, 0 commissions, 0 pilot subscribers. This page gives outreach recipients a concrete trust artifact before Pete sends the first batch.