webhook-subscriptions

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that pass or return HMAC/API secrets (e.g., --secret on the CLI and "Returns the webhook URL and HMAC secret"), which requires the agent to handle and potentially output secret values verbatim (an insecure exfiltration pattern).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly accepts POSTs from external services (e.g., "external services (GitHub, GitLab, Stripe, ... ) can trigger Hermes agent runs by POSTing events to a URL") and its docs state that "If no prompt is specified, the full JSON payload is dumped into the agent prompt" and that incoming POSTs are formatted into prompts and trigger agent runs, meaning untrusted third-party payloads can directly influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The generated webhook endpoint (the returned webhook_url — i.e., the URL you configure as the "Payload URL" in GitHub/Stripe/etc.) is used at runtime to receive external JSON POSTs which are directly injected into or formatted into agent prompts, so incoming remote content can control agent instructions.