hermes-agent-mission-control

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md includes workflow examples where Minions runs autonomous Hermes tasks that fetch and analyze public websites (e.g., "Analyze competitor pricing pages" and the routine "Check GitHub stars and create summary report"), which implies the agent will ingest untrusted, user-generated/open web content as part of its execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README tells users to run "npx minionsai", which at runtime fetches and executes code from the npm registry (e.g. https://registry.npmjs.org/minionsai or https://www.npmjs.com/package/minionsai), so remote content is executed and is a required runtime dependency.