hermesfusion-multi-model-panel
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches source code from a GitHub repository (github.com/GiannoKlein9/HermesFusion.git) and a PyPI package (hermesfusion) that are not associated with a known trusted vendor.
- [REMOTE_CODE_EXECUTION]: The installation instructions require the user to download and execute code from an unverified remote source via git and pip.
- [COMMAND_EXECUTION]: The skill operates by orchestrating model calls through the execution of shell commands defined in a YAML configuration file.
- [COMMAND_EXECUTION]: User-supplied inputs are interpolated directly into shell commands using the {prompt} placeholder. This pattern poses a high risk of command injection if the input is not strictly validated or if the underlying execution logic uses a shell.
- [DATA_EXFILTRATION]: Provides a mechanism (passthrough_env: true) to forward the parent process environment, which often contains sensitive API keys and credentials, to all child processes executed by the tool.
- [PROMPT_INJECTION]: The skill ingests and processes untrusted data from external files and user input that is then used as parameters for shell-level command execution.
- Ingestion points: Prompt data entering through the --prompt and --prompt-file flags in the SKILL.md examples.
- Boundary markers: None identified in the prompt templates to distinguish user-provided content from agent instructions.
- Capability inventory: Execution of arbitrary shell commands as defined in the provider recipes.
- Sanitization: No documented sanitization, escaping, or validation of prompt data before shell interpolation.
Audit Metadata