hermes-skill-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow’s “Discover inventory”/“Validate bundles” steps cause the agent at runtime to read inspected SKILL.md/README/reference files from the user’s installed Hermes skills (repository files uploaded/maintained by other parties), i.e., outsider-authored free-text from those bundles is ingested as evidence into the LLM context, creating an indirect prompt-injection surface despite the stated Untrusted Content Boundary.