hermesone

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, the hermesone skill fetches GitHub release metadata and release asset manifests from the outsider publisher fathah/hermes-desktop (public web/GitHub content), and that fetched text (e.g., release YAML/manifest fields used to resolve tag/asset/url/sha512) is ingested into the agent’s LLM context via the skill’s CLI/API outputs (e.g., plan/progress/status lines).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill downloads and installs native builds at runtime from the GitHub releases for https://github.com/fathah/hermes-desktop (fetching release assets/manifests like latest.yml and the platform installers) which are executed on the host, so it relies on remote content that runs code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to download, verify, and install third‑party native code (modifying host state such as /Applications, launching installers, and supporting auto-install postinstall behavior), so it directs actions that change the machine.