The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an untrusted GitHub user (xaspx/hermes-control-interface) and install dependencies using npm install without version pinning or integrity checks.
[PRIVILEGE_ESCALATION]: The deployment documentation provides a systemd service configuration that runs the Node.js application as the root user (User=root). This is a significant security risk as it grants the web dashboard and any user with terminal access administrative control over the entire system.
[PERSISTENCE]: The skill includes instructions to create and enable a systemd service (hermes-control.service), ensuring that the potentially vulnerable dashboard persists across system reboots.
[DYNAMIC_EXECUTION]: The dashboard exposes a web-based terminal interface powered by node-pty and xterm.js, enabling the execution of arbitrary shell commands through the /terminal WebSocket endpoint.
[COMMAND_EXECUTION]: The application provides an API for managing cron jobs (/api/cron), which allows for the creation and scheduling of arbitrary system commands to be executed in the background.
[INDIRECT_PROMPT_INJECTION]: The skill presents a substantial attack surface for indirect prompt injection. It processes untrusted data from multiple sources while possessing high-impact system capabilities.
Ingestion points: External chat messages processed via /api/chat/send and user-supplied file content written via /api/files/write.
Boundary markers: No explicit delimiters or safety instructions are mentioned to prevent the agent from following instructions embedded in processed data.
Capability inventory: The skill has access to terminal execution, file system modification, cron scheduling, and system diagnostics with auto-fixing capabilities.
Sanitization: While basic path scoping is mentioned for the file explorer, the terminal and cron functionalities do not appear to restrict the scope of executed commands.

hermes-control-interface-dashboard