The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted data from external webhook providers and interpolating it into prompts.
Ingestion points: Incoming POST payloads from services like GitHub, GitLab, Stripe, and generic monitoring tools provide data (e.g., {issue.body}, {pull_request.body}, {alert.message}) that is used in prompt templates.
Boundary markers: The provided examples do not use delimiters (like XML tags or triple quotes) or explicit instructions to the agent to ignore potentially malicious content embedded in the webhook payload.
Capability inventory: Triggered agent runs have access to other skills and tools, creating a risk that an attacker-controlled webhook payload could execute unauthorized actions.
Sanitization: No evidence is provided that the skill performs validation, escaping, or sanitization of external content before it is processed by the LLM.
[PERSISTENCE]: The skill uses standard service management techniques to maintain long-term execution of the gateway process.
Evidence: Instructions include setting up and restarting user-level systemd services (systemctl --user restart hermes-gateway) to ensure the webhook listener remains active across sessions. Subscription configurations are also persisted locally to ~/.hermes/webhook_subscriptions.json.

webhook-subscriptions