The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/chinese-tts-voices.md contains a hardcoded API key for ElevenLabs: sk_18bd08aa589d83391dbe1c859c090f041b4e7b43d1af68b2. While the file notes it should be in .env, the literal key is present in the documentation.
[REMOTE_CODE_EXECUTION]: The SKILL.md file encourages users to install the agent by piping a remote script directly to the shell: curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash. This is a high-risk pattern as the script execution is unverified.
[REMOTE_CODE_EXECUTION]: The skill explicitly instructs users on how to bypass the internal security scanner (skills_guard.py) by using a separate clawhub CLI to publish skills that would otherwise be blocked as 'DANGEROUS'.
[PROMPT_INJECTION]: The skill documents the use of a --yolo flag and a YOLO_MODE environment variable specifically designed to 'Skip dangerous command approval' and 'bypass everything'.
[COMMAND_EXECUTION]: The skill relies on extensive shell command execution through the terminal() tool for tasks such as agent spawning via tmux, profile creation, and dependency management.
[EXTERNAL_DOWNLOADS]: The skill guides the user to download and install numerous external dependencies and binary tools, including the clawhub CLI via npm, and various AI models from hf-mirror.com.
[PERSISTENCE]: The documentation includes instructions for maintaining persistent background processes using systemd (hermes gateway install) and loginctl enable-linger to keep services running after logout.
[PRIVILEGE_ESCALATION]: The skill provides instructions for commands requiring elevated privileges, such as sudo apt install for system dependencies and sudo loginctl for session management.
[DATA_EXFILTRATION]: The skill allows the agent to read and write system files, access environment variables containing secrets, and perform network operations. While redaction features are mentioned, they are off by default.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection.
Ingestion points: Processes untrusted data from messaging platforms (Telegram, WeChat), web content, and local file reads.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are documented for the processing of external data.
Capability inventory: The agent has full system access, including subprocess execution, file system modification, and network requests.
Sanitization: The skill mentions optional secret and PII redaction, but these must be manually enabled and do not cover all injection vectors.

hermes-agent