webhook-subscriptions
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external services and interpolate it directly into the agent's prompt, creating an indirect prompt injection surface.\n
- Ingestion points: External webhook payloads from third-party services such as GitHub, GitLab, and Stripe are ingested via POST requests.\n
- Boundary markers: The provided prompt templates (e.g.,
--prompt "New GitHub issue #{issue.number}: {issue.title}...") do not use delimiters or instructions to isolate potentially malicious data within the variable fields from the agent's core instructions.\n - Capability inventory: The agent has the capability to execute specific skills and deliver results to external integrations like Telegram, Discord, and GitHub comments, which could be exploited through malicious payloads.\n
- Sanitization: There is no evidence of sanitization or validation of the incoming payload content before it is processed by the agent.\n- [DATA_EXFILTRATION]: The skill documents and manages sensitive configuration files at
~/.hermes/config.yaml,~/.hermes/.env, and~/.hermes/webhook_subscriptions.json. These files contain HMAC secrets and other configuration data. While these interactions are part of the intended management of the Hermes tool, they involve sensitive file paths that could be targets for exposure.
Audit Metadata