The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit.py performs file system management operations within the agent's environment. It uses shutil.rmtree and Path.unlink to delete skill directories in ~/.hermes/skills/ and ~/.agents/skills/. It also modifies the ~/.hermes/config.yaml file to disable builtin skills. These actions are protected by a default dry-run mode and require explicit user confirmation via the --execute flag.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) through its reporting mechanism.
Ingestion points: Untrusted data enters the context via the messages table in the SQLite database ~/.hermes/state.db (analyzed in scripts/audit.py).
Boundary markers: Absent. Skill names and tool arguments retrieved from the database are interpolated directly into Markdown f-strings for the report.
Capability inventory: The skill has the ability to delete directories, unlink files, and modify the agent's main configuration file (scripts/audit.py).
Sanitization: No escaping or sanitization is performed on the data retrieved from the database history. Maliciously crafted skill names (e.g., containing Markdown syntax or control characters) could potentially disrupt the report's presentation or influence the user's perception of the audit results.

skill-audit