The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to install the agent using the command curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash. This pattern of piping remote scripts directly to a shell is a critical security vulnerability as it allows for the execution of unverified code with the user's full privileges.
[REMOTE_CODE_EXECUTION]: The hermes skills install command is documented to accept direct HTTPS URLs for installing new skills. This mechanism allows the agent to download and execute untrusted instruction sets or scripts from arbitrary remote sources.
[REMOTE_CODE_EXECUTION]: The skill provides instructions for adding Model Context Protocol (MCP) servers via URLs or shell commands using hermes mcp add, which presents a direct vector for loading and running external code.
[COMMAND_EXECUTION]: The framework includes a --yolo flag and a security.approvals.mode: off configuration that disables safety confirmation prompts for destructive shell commands. This bypasses critical safety filters designed to prevent accidental or malicious system damage.
[CREDENTIALS_UNSAFE]: The documentation explicitly identifies the locations of sensitive files such as ~/.hermes/.env (API keys) and ~/.hermes/auth.json (OAuth tokens). Providing these paths in the skill content helps map an attack surface for credential theft.
[DATA_EXFILTRATION]: The architecture of the agent combines high-privilege system tools (terminal and file system access) with numerous messaging gateways (Telegram, Discord, Slack). This combination creates a significant risk for the exfiltration of sensitive data or harvested credentials to external platforms.
[PROMPT_INJECTION]: The /steer slash command allows for the injection of user-defined instructions into the conversation flow after a tool has executed, which could be used to manipulate agent behavior or bypass operational constraints.

hermes-agent