hermes-insights
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories including
~/.claude/projects/and~/.claude/skills/. These paths contain historical session data, decisions, learned facts, and project-specific metadata. While no network exfiltration patterns (such as curl or fetch) were detected, the skill requires read access to the user's full interaction history with the agent. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
lsandfindto crawl the local filesystem and identify session memory files for analysis. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it processes untrusted data from external session memory files.
- Ingestion points: Reads files at
~/.claude/projects/*/memory/session_*.md. - Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore embedded instructions within the processed logs.
- Capability inventory: Uses
lsandfindto locate data; analysis is performed within the agent context. - Sanitization: No explicit sanitization or filtering of the content from memory files is mentioned before processing.
Audit Metadata