hermes-client-web-ui
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides default hardcoded credentials ('admin@admin.com' / '123456') for the web interface, which can lead to unauthorized access if not changed immediately.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone code from a third-party, untrusted GitHub repository ('github.com/lotsoftick/hermes_client.git') that is not associated with the skill author or a trusted organization.
- [REMOTE_CODE_EXECUTION]: The installation process involves executing the downloaded code directly using 'npm start', which allows for arbitrary code execution from the remote source.
- [COMMAND_EXECUTION]: The documented API architecture snippets show user-controlled variables such as 'profileName' and 'message' being passed directly into 'spawn()' calls for the 'hermes' CLI. The lack of visible sanitization or validation presents a significant risk of shell command injection.
- [PERSISTENCE]: The skill's setup process ('npm start') automatically installs persistence mechanisms, specifically LaunchAgents on macOS and Startup items on Windows, ensuring the application runs across sessions.
- [PRIVILEGE_ESCALATION]: The documentation explicitly advises users to run terminal sessions with Administrator privileges on Windows to facilitate global system changes like 'npm link' and auto-start configuration.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a broad attack surface for indirect injection vulnerabilities:
- Ingestion points: Untrusted data enters the context via API request bodies (messages, profile names), file uploads, and by watching local session files ('~/.hermes/profiles//sessions/.json').
- Boundary markers: There are no delimited boundaries or safety instructions to prevent the underlying 'hermes' agent from interpreting data as instructions.
- Capability inventory: The skill facilitates shell command execution via PTY and 'spawn', extensive file system access (reading, writing, and watching), and local database operations.
- Sanitization: The implementation patterns shown do not include input escaping, validation, or filtering of the external content before processing.
Recommendations
- AI detected serious security threats
Audit Metadata