byreal-hermes-deploy-native

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required install flow explicitly downloads and installs code/assets from public GitHub (Step 2's curl of the uv release and Step 3's git clone of HERMES_AGENT_REPO) — untrusted third‑party content that is fetched and executed/installed as part of the workflow and thus can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install flow fetches and executes remote artifacts at runtime — notably the uv release tarball from https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${UV_ASSET} and the hermes-agent git repo at https://github.com/NousResearch/hermes-agent.git — which are required dependencies and result in executing remote code on install.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly handles blockchain wallets and prepares the agent for on-chain operations. It runs wallet-info via an agent-token script and byreal-cli to obtain wallet addresses, writes "USER.md" with those addresses, and states "RealClaw Privy server-side wallets — Hermes uses these for on-chain ops." It also notes TOOLS.md is needed for chain addresses/program IDs. These are specific crypto/wallet integrations (not generic tooling), so the skill enables crypto on-chain operations and therefore qualifies as direct financial execution capability.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs the agent to modify user shell files, create/symlink and delete directories, write configs with secrets, kill and restart processes, clone and install software and even conditionally run sudo apt-get to install system packages—actions that change the host state and can require elevated privileges.