Summary

Cron jobs that load user-created skills fail with false-positive security blocks. Skills from ~/.hermes/skills/ commonly contain educational code examples (e.g., github-auth documenting curl with $GITHUB_TOKEN) that trigger the exfil_curl and read_secrets threat patterns.

Root Cause

_build_job_prompt assembles the user prompt + loaded skill content into one string, then calls _scan_assembled_cron_prompt (introduced by #3968) which scans the entire result. User-created skills with code snippets match threat regex patterns that were designed for malicious user input — not for trusted skill documentation.

Fix

Before scanning, check if all loaded skills reside under ~/.hermes/skills/ (the user's own skills directory). If yes, only scan the user-supplied prompt for threats — skill content is trusted. If any skill is from an external/plugin source, scan the full assembled prompt (preserving the #3968 protection).

Testing

• Cron job with user-created skill containing curl examples: should pass ✅
• Cron job with malicious external skill: still blocked ✅
• Cron job without skills: unchanged behavior ✅

Related

• Security: Cron prompt injection via skill content bypasses scanner #3968 (assembled-prompt scanning)
• This fixes the false-positive regression from Security: Cron prompt injection via skill content bypasses scanner #3968 without reopening the injection vector.