input-token-analysis
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's audit script (
scripts/audit.py) queries~/.hermes/state.db, a sensitive file path containing the agent's full conversation history and metadata. Although the script focuses on summary statistics and only outputs session titles rather than message bodies, this metadata exposure to the agent's context is a sensitive operation. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted session titles from the database to generate its audit reports.
- Ingestion points:
~/.hermes/state.db(specifically session titles and tool names). - Boundary markers: The script uses
repr()for titles but lacks explicit instructions for the agent to disregard instructions potentially embedded in that data. - Capability inventory: The agent is instructed to run the provided Python script and interact with the system using the
hermesCLI tool. - Sanitization: Titles are truncated to 40 characters and escaped using the
repr()function. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a Python script included in the skill package and use the
hermesCLI to perform configuration updates and cron job modifications, which are significant system-level operations.
Audit Metadata