hermes-agent-control-room
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires cloning a management framework from 'https://github.com/shannhk/hermes-agent-control-room.git', which is a personal repository not listed as a trusted organization or well-known service.\n- [PERSISTENCE]: The setup process links bundled scripts from the cloned repository into the agent's persistent skill directory ('~/.claude/skills'), allowing third-party code to persist and execute across future sessions.\n- [REMOTE_CODE_EXECUTION]: The skill downloads external scripts and integrates them into the agent's execution path, creating a mechanism to execute arbitrary code fetched from the 'shannhk' repository.\n- [INDIRECT_PROMPT_INJECTION]: The architecture uses a 'Task Bus' where an Orchestrator agent reads and synthesizes results from markdown files generated by Specialist agents (e.g., 'result-002.md'). Ingestion points are the files in '/srv/agent-bus/outbox/'. There are no boundary markers or instructions to isolate data from instructions, and no evidence of output sanitization, allowing a compromised specialist to inject instructions into the orchestrator's synthesis phase.\n- [COMMAND_EXECUTION]: The skill instructs the agent to perform administrative tasks on a VPS, including firewall management ('ufw'), 'docker-compose' operations, and file system modifications.
Audit Metadata