hermes-compress
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted conversation history and transforms it into a structured summary that influences future sessions. 1. Ingestion points: Reads all messages in the current conversation, including user turns and tool outputs (Step 1). 2. Boundary markers: The extracted content is formatted as a YAML block but lacks explicit delimiters or instructions to ignore embedded commands. 3. Capability inventory: The skill performs file system writes to the ~/.claude/projects/ directory and updates the MEMORY.md index file. 4. Sanitization: No sanitization or validation of the summarized content is performed to prevent the propagation of malicious instructions.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform automated file system operations, including directory creation and appending to index files (MEMORY.md) within the agent's project configuration paths (~/.claude/projects/).
Audit Metadata