agent-repo-handoff-loop
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMPERSISTENCEDATA_EXFILTRATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill automates the creation and management of several cron jobs (‘carsah-auto-wake’, ‘carsah-auto-rotate’, and ‘carsah-stuck-watchdog’) to ensure continuous background operation of the review loop across system sessions.
- [DATA_EXFILTRATION]: The skill accesses sensitive internal agent files, including the state database (‘
/.hermes/state.db’) and execution logs (‘/.hermes/logs/agent.log’), to retrieve message counts and session activity for its automated management logic. - [DYNAMIC_EXECUTION]: Automated maintenance scripts ‘carsah_auto_rotate.sh’ and ‘carsah_auto_wake.sh’ use ‘sed’ to programmatically modify their own source code and other script files at runtime to update session identifiers.
- [COMMAND_EXECUTION]: The skill makes extensive use of powerful shell commands to manage system processes (‘pgrep’, ‘pkill’, ‘nohup’), interact with databases (‘sqlite3’), and perform hardware interactions via Android Debug Bridge (‘adb shell’).
- [INDIRECT_PROMPT_INJECTION]: The architecture reads and executes instructions delivered through a Git ‘mailbox’ (‘handoff/’ directory), creating a surface where malicious content pushed to the repository could influence agent behavior.
- Ingestion points: Data is ingested via ‘git log’ and by reading files from the ‘handoff/’ directory in the remote repository.
- Boundary markers: The protocol relies on a specific markdown structure for messages but does not implement strict sanitization or escaping of the ingested content.
- Capability inventory: The agent has capabilities to launch new sessions via ‘hermes chat’, interact with local databases, and execute hardware-level commands via ADB.
- Sanitization: There is no evidence of content sanitization for data retrieved from the external repository before it is interpolated into agent directives.
- [REMOTE_CODE_EXECUTION]: The skill fetches content from a remote Git repository (‘git pull --rebase’) and subsequently executes instructions derived from that content using ‘hermes chat --resume’ commands.
Audit Metadata