agent-skills-discovery
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONMETADATA_POISONING
Full Analysis
- [REMOTE_CODE_EXECUTION]: Installs the RunPod CLI from the official domain using
curl -sSL https://cli.runpod.net | bash.\n- [REMOTE_CODE_EXECUTION]: Facilitates the installation of agent skills from remote GitHub repositories usingnpx skills addandgh skill install.\n- [INDIRECT_PROMPT_INJECTION]: Ingests and processes content from web search results via the Exa MCP tool to verify skill canonicalization and metadata.\n - Ingestion points: Workflow Step 1 in
SKILL.mduses results from themcp__exa__web_search_exatool.\n - Boundary markers: Absent; the instructions rely on the agent to manually parse specific text fields from the results.\n
- Capability inventory: Includes shell command execution (
npx,gh,curl) and file system operations to manage skills.\n - Sanitization: Includes basic text processing steps such as cleaning markers and collapsing duplicate search results.\n- [COMMAND_EXECUTION]: Uses local shell utilities including
find,awk,sed,comm, andcutto generate inventory reports and compare disk state against bundled skill manifests.\n- [DYNAMIC_EXECUTION]: Scans for and processes skill definitions (SKILL.md) in user-controlled and shared system directories, such as~/.hermes/skills/and~/.agents/skills/.\n- [METADATA_POISONING]: The skill metadata identifies the author as 'Hermes Agent', which contradicts the submitter identity 'rajivmehtaflex'. The skill body notes that author fields are often unreliable and suggests alternative verification methods.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.runpod.net - DO NOT USE without thorough review
Audit Metadata