before you enable a community hermes skill, plugin or mcp server, answer five things:
who can trigger it. which tools it gets. where its commands run. which credentials it can read. how you stop it.
a directory listing is discovery, not a security review.