If you discover a security vulnerability in dynamic-model-delegation, please do not open a public issue. Instead, report it privately:

1. Email: Open an issue with the title [SECURITY] and describe the vulnerability
2. Response time: We aim to respond within 48 hours
3. Disclosure: After a fix is released, we will credit the reporter (unless anonymity is requested)

• Spawn hermes chat -q subprocesses with model-specific -m flags
• Read task definitions from JSON (argv or stdin)
• Write results to stdout as JSON
• Use the workdir field as cwd for subprocess execution (validated to absolute, existing paths only)

• Execute arbitrary shell commands (uses list-based create_subprocess_exec, no shell)
• Access credentials (model strings are public identifiers; API keys are read by hermes, not this script)
• Modify files outside the specified workdir
• Bypass Hermes Agent's own security controls (redact_secrets, tirith, etc.)

• Credential exfiltration via malicious PR: The orchestrator inherits the full environment including API keys. A malicious code change could exfiltrate them. Mitigation: human code review required for all PRs. No automated CI/secret scanning yet.
• Rate limit exhaustion: Tasks are dispatched to real model providers. An attacker can exhaust API rate limits by submitting many tasks. Mitigation: MAX_TASKS=50 cap, Semaphore(3) concurrency gate, and each task consumes one API call.

This skill follows the principle of least privilege: it does only what's needed to spawn model-specific subprocesses. Every input is validated. Every subprocess is cleaned up. Every attack surface identified during red-teaming has been hardened.