skill-ingest

name	skill-ingest
description	End-to-end ingestion of a third-party skill/MCP source — fetch → quarantine → classify → audit → vault. A FAIL audit hard-blocks; Tier 2/3 needs --confirm (#6, Phase 4).
version	1.1.0
platforms	["linux","macos"]
metadata	{"hermes":{"tags":["ingestion","supply-chain","security","vetting","quarantine","audit","vault","skills","mcp"],"related_skills":["security","reviewer","security-auditor","vetted-vault","container-runner","skill-discovery"]}}

Skill Ingest

The "door" that makes the security guards load-bearing — the only sanctioned way a third-party skill or MCP server enters the vault (Backlog #6, Phase 4). The pipeline:

fetch -> quarantine -> classify tier -> security audit
    FAIL      -> hard block (nothing vaulted)
    PASS/WARN -> vault (immutable lock-in copy)   [Tier 2/3 require --confirm]

Nothing fetched is ever executed during ingestion — the auditor is static + LLM only, and execution happens later through the container-runner (sandboxed). The quarantine copy is always cleaned up; the vault holds the kept copy.

When to use

Only when a non-local skill/MCP source is being considered for injection. Local (Tier 1) skills matched by the curator are auto-approved and bypass this path.

Dispatch

terminal(command="python3 ~/.hermes-coder/scripts/skill_ingest.py ingest --source '<path-or-git-url>' --name '<tool>' --origin '<org>' --json", workdir="~/.hermes-coder", timeout=600)

After a human reviews a Tier 2/3 source (status awaiting_confirmation), re-run with --confirm. Flags: --source (local path or git/http(s) URL), --name (required), --origin, --confirm, --static-only, --engine (coding harness for the LLM audit pass; default coding.default_engine), --model (deprecated/ignored — the audit uses the coding harness), --json.

Reading the output (--json)

IngestReport: name, source, tier, verdict, vaulted, vault_path, status (approved|blocked|awaiting_confirmation|error), findings_summary (static/llm FAIL/WARN counts + top_static), warning, command_preview, error.

Safety rules

• A blocked status (audit FAIL) hard-blocks — do not vault or inject the source.
• awaiting_confirmation (Tier 2/3) means a human must read the quarantined source before approval; only --confirm after the user signs off (there is no auto-approval of untrusted code).
• Execute a vaulted tool only via the container-runner, never on the host.
• Provenance required — no fabricated skills. A bare local-path --source is accepted only when it lives under a first-party root (~/.hermes-coder/skills or scripts/). Any other local path is rejected (exit 2): a skill must arrive via a real remote URL (verifiable provenance) or through skill-discovery, which clones from a verified remote before ingesting. This stops a hand-authored SKILL.md dropped in /tmp from being vaulted as if it were trusted. (Discovery sets an internal trusted_local flag for its temp clone; the CLI never exposes it.)

Exit codes

Code	Meaning
0	Vaulted / approved
1	Blocked — audit FAIL, or Tier 2/3 awaiting --confirm
2	Invalid arguments / fetch failed
3	LLM harness unavailable during audit (static-only audit still gated the decision)