tui-widgets
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill enables script generation and local execution by instructing the agent to write ESM JavaScript files to the
~/.hermes/tui-widgets/directory, which the Hermes TUI hot-loads and executes. - [COMMAND_EXECUTION]: The documentation describes procedures for persistent widget registration and slash command setup within the Hermes TUI application environment.
- [PROMPT_INJECTION]: The widget framework ingests user-supplied arguments and external API data, creating a potential surface for indirect prompt injection if the inputs are not properly sanitized by the generated widget logic.
- [DATA_EXFILTRATION]: The skill mentions handling API credentials for network-backed widgets, which necessitates careful management to prevent data exposure or exfiltration within the dynamically generated scripts.
Audit Metadata