hermes-agent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The list contains a direct raw GitHub install script (curl|bash) and a non-official/typosquat-looking base URL (chatgpt.com) referenced as a provider endpoint, both of which are common vectors for delivering or redirecting to malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This document describes multiple high-risk features that can be abused for remote code execution, credential exfiltration, and supply-chain compromise (curl|bash installer, arbitrary remote-skill installs with auto-imported code, shell/terminal tool execution with approval-bypass options, webhooks/debug upload endpoints, and local secret stores).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start includes a curl piped to bash that fetches and executes remote code from https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh, which is a runtime installation step that runs external code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly recommends running privileged/system-level commands (e.g., "hermes gateway install" and "sudo loginctl enable-linger $USER") and editing system files like /etc/wsl.conf or service state via systemctl, which require sudo or otherwise modify the host system state.