hermes-agentmesh-async-bus
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Modifies system-level configuration files (
redis.conf) usingsudoto permit network-wide access. - [EXTERNAL_DOWNLOADS]: Clones source code from an unverified GitHub repository (
seleman66eeddwegger3-art/hermes-agentmesh). - [EXTERNAL_DOWNLOADS]: Fetches and executes scripts (
worker_node.py,orchestrator_async.py) from an unauthenticated local HTTP server. - [COMMAND_EXECUTION]: Configures persistent background tasks using macOS LaunchAgents and Linux systemd services to ensure agent workers survive reboots and logouts.
- [DATA_EXFILTRATION]: Explicitly instructs the user to disable Redis
protected-modeand bind the service to0.0.0.0, exposing the agent communication bus—which carries task data and LLM responses—to any device on the local network. - [PROMPT_INJECTION]: Indirect prompt injection surface identified via the asynchronous Redis queue.
- Ingestion points: Worker scripts in
worker_node.pyconsume JSON-formatted tasks from Redis queues (inbox:<NODE_NAME>). - Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when passing task data to the LLM.
- Capability inventory: The worker scripts perform network operations to an LLM API and write output back to shared Redis queues.
- Sanitization: No validation or sanitization of the JSON task payload is implemented before processing.
Audit Metadata