hermes-attestation-guardian

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow fetches and parses a remote or local security advisory feed (lib/feed.mjs), which contains community-sourced advisory records.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill fetches an operational advisory feed via https://clawsec.prompt.security/advisories/feed.json (and associated signed checksum artifacts) during runtime execution, using common/reputable unofficial prompt.security infrastructure provenance.