hermes-agent-guide

Warn

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONALDYNAMIC_EXECUTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The VPS deployment guide provides shell commands utilizing sudo for administrative tasks, such as installing system packages and managing systemd services.
  • [PERSISTENCE]: The skill instructs the user on setting up a persistent systemd unit (hermes-agent.service) and using systemctl enable to ensure the agent starts automatically upon system boot.
  • [REMOTE_CODE_EXECUTION]: The installation process involves cloning code from an external repository (github.com/NousResearch/hermes-agent) and running it locally. The skill also documents using npx to fetch and execute Model Context Protocol (MCP) servers from a public registry at runtime.
  • [DYNAMIC_EXECUTION]: The framework documentation includes a CodeExecutionTool capable of executing arbitrary Python code, with a configurable sandbox mode that can be toggled via environment variables.
  • [TIME_DELAYED_CONDITIONAL]: The framework features a CronScheduler and EventTrigger system that can be configured to execute agent logic based on scheduled times or specific system events such as file modifications and database changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture designed to process untrusted external data, creating potential for injection attacks.
  • Ingestion points: Untrusted data enters the agent context via WebSearchTool, WebScrapingTool, GitHubTool, and DatabaseTool as documented in SKILL.md.
  • Boundary markers: The provided code snippets and prompts do not include explicit boundary markers or instructions to disregard embedded commands in the data.
  • Capability inventory: The framework provides extensive capabilities including file system modification (FileSystemTool), code execution (CodeExecutionTool), network operations (APIRequestTool), and database manipulation.
  • Sanitization: Integration examples do not demonstrate sanitization, validation, or escaping of external content before it is interpolated into the agent's context.
  • [COMMAND_EXECUTION]: The skill provides numerous shell snippets for local environment setup, virtual environment management, and container orchestration using docker-compose.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 12, 2026, 06:50 PM
Security Audit — agent-trust-hub — hermes-agent-guide