hermes-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's messaging gateway (references/messaging.md and SKILL.md) explicitly connects to public platforms like Telegram, Discord, Slack, WhatsApp, Signal, SMS and Email and ingests inbound user messages/commands—which the agent reads and can trigger tools (terminal access, background tasks, approvals, skill installs), so untrusted third‑party content can materially influence its actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's installation steps fetch-and-execute remote scripts (e.g., curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash and curl -LsSf https://astral.sh/uv/install.sh | sh), which run external code during setup and are required to install the agent.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs running sudo commands and installing system-wide services (e.g., "sudo loginctl enable-linger $USER" and "sudo hermes gateway install --system"), which require elevated privileges and modify system/service files, so it pushes the agent to change the machine state.