hermes-agent-guide
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONALDYNAMIC_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The VPS deployment guide provides shell commands utilizing
sudofor administrative tasks, such as installing system packages and managing systemd services. - [PERSISTENCE]: The skill instructs the user on setting up a persistent systemd unit (
hermes-agent.service) and usingsystemctl enableto ensure the agent starts automatically upon system boot. - [REMOTE_CODE_EXECUTION]: The installation process involves cloning code from an external repository (
github.com/NousResearch/hermes-agent) and running it locally. The skill also documents usingnpxto fetch and execute Model Context Protocol (MCP) servers from a public registry at runtime. - [DYNAMIC_EXECUTION]: The framework documentation includes a
CodeExecutionToolcapable of executing arbitrary Python code, with a configurable sandbox mode that can be toggled via environment variables. - [TIME_DELAYED_CONDITIONAL]: The framework features a
CronSchedulerandEventTriggersystem that can be configured to execute agent logic based on scheduled times or specific system events such as file modifications and database changes. - [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture designed to process untrusted external data, creating potential for injection attacks.
- Ingestion points: Untrusted data enters the agent context via
WebSearchTool,WebScrapingTool,GitHubTool, andDatabaseToolas documented inSKILL.md. - Boundary markers: The provided code snippets and prompts do not include explicit boundary markers or instructions to disregard embedded commands in the data.
- Capability inventory: The framework provides extensive capabilities including file system modification (
FileSystemTool), code execution (CodeExecutionTool), network operations (APIRequestTool), and database manipulation. - Sanitization: Integration examples do not demonstrate sanitization, validation, or escaping of external content before it is interpolated into the agent's context.
- [COMMAND_EXECUTION]: The skill provides numerous shell snippets for local environment setup, virtual environment management, and container orchestration using
docker-compose.
Audit Metadata