nemoclaw-contributor-update-hermes

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill “Update Hermes” reads outsider-authored free text at runtime by ingesting GitHub release and tag-ref JSON fetched from NousResearch/hermes-agent via the gh api ... /releases and ... /git/matching-refs/tags/... endpoints, then parsing their record fields (including tag and metadata) in scripts/collect-hermes-release-supplement.py.