inspecting-hermes-desktop-dom
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading live DOM content from the application renderer, which may include untrusted data from messages or external sources.\n
- Ingestion points: The skill instructions (SKILL.md) describe methods to read computed styles, geometry, and DOM elements directly from the running application instance.\n
- Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted DOM data from agent instructions.\n
- Capability inventory: The skill possesses capabilities to execute local shell commands (via
nodeandnpx electron) and evaluate JavaScript in the renderer (viacdp.eval()).\n - Sanitization: No sanitization or validation of the ingested DOM content is mentioned or implemented in the provided snippets.\n- [DYNAMIC_EXECUTION]: The skill utilizes
cdp.eval()and a local script (apps/desktop/scripts/eval.mjs) to execute JavaScript strings within the application renderer context to retrieve UI facts.\n- [COMMAND_EXECUTION]: The skill provides commands to run local Node.js scripts (node scripts/eval.mjs) and launch Electron instances (npx electron .) with specific flags and environment variables for isolated debugging.
Audit Metadata