The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses node:child_process.spawn to execute the ssh binary for creating tunnels. The remoteHost parameter, which is configurable via the setup command's --remote-host flag, is passed as a direct command-line argument. This allows for argument injection; if the parameter is set to a string starting with a hyphen (e.g., -oProxyCommand=touch /tmp/pwned), the ssh binary will interpret it as an option, leading to arbitrary command execution.
Evidence: In scripts/lib/connection.mjs, the startTunnel function passes ssh.remoteHost directly into the spawn call for the ssh process.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill facilitates the storage of a Hermes API key in a local configuration file. When the setup command is run with the --json flag, the utility outputs the entire configuration object to stdout, exposing the apiKey in plain text to the AI agent and the conversation history.
Evidence: The cmdSetup function in scripts/hermes-companion.mjs calls output(result, true) where result contains the raw config object returned by resolve().
[DATA_EXPOSURE_AND_EXFILTRATION]: The ssh tunnel implementation uses the -o StrictHostKeyChecking=accept-new flag. This automatically accepts new host keys without user verification, which can facilitate man-in-the-middle attacks if the connection is made to a spoofed remote host.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to receive and display output from a remote Hermes agent. The instructions in SKILL.md and commands/chat.md explicitly direct the agent to return this remote output "verbatim" without any sanitization, filtering, or the use of boundary markers. This creates a surface for a malicious or compromised remote service to inject instructions that the local agent may follow.
Ingestion points: api.chat, api.streamChat, and api.streamRunEvents in scripts/lib/hermes-api.mjs ingest data via fetch calls to the Hermes Gateway.
Boundary markers: Absent; instructions specifically require returning the response verbatim.
Capability inventory: The skill has the ability to execute shell commands via the node helper and establish SSH tunnels.
Sanitization: Absent; output is processed directly through the render.mjs library and printed to stdout.

hermes-runtime