hermes - 💡(How to fix) Fix [Feature] SSL-based Risk Policy Engine cho Skills [1 participants]

TL;DR

Implement a policy engine to enforce SSL risk scores, requiring explicit user approval for skills with a risk score of 7 or higher.

Guidance

• Review the ssl_normalizer.py and skill_discovery.py scripts to understand the current SSL risk score computation and skill discovery processes.
• Develop a policy engine that reads risk scores from the ssl_index.json file and enforces the proposed rules (e.g., blocking skills with a risk score of 10 or higher).
• Design a user confirmation approach, such as a Telegram inline button or CLI confirmation, to obtain explicit approval for high-risk skills.
• Consider implementing a UI for policy exceptions to handle edge cases.

Example

No code snippet is provided due to the lack of specific implementation details.

Notes

The proposed solution requires additional development effort to implement the policy engine, user confirmation approach, and policy exceptions UI.

Recommendation

Apply the proposed workaround by implementing a policy engine to enforce SSL risk scores, as it addresses the current lack of enforcement mechanism and provides a clear path forward for mitigating high-risk skills.