hermes-feishu-streaming-card
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download a release package from an unverified GitHub repository (
https://github.com/baileyh8/hermes-feishu-streaming-card/releases/latest/download/hermes-feishu-streaming-card.tar.gz). - [REMOTE_CODE_EXECUTION]: The downloaded package is subsequently executed/installed using
pip install .. Since the source is an unknown GitHub user, this constitutes high-risk remote code execution. - [COMMAND_EXECUTION]: The skill requires multiple shell commands to be executed, including downloading external files, extracting archives, and using a custom CLI tool (
hermes-feishu-card) to perform system modifications. - [DYNAMIC_EXECUTION]: The skill performs dynamic modification of the host application's environment. The
hermes-feishu-card installcommand is designed to inject hooks into the Hermes Gateway source code (specifically targeting~/.hermes/hermes-agent/gateway/run.py), which modifies the execution flow of the primary agent gateway. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection.
- Ingestion points: The
StreamingCardHookandsidecarprocess ingest streaming deltas (thinking.delta,answer.delta) and tool events (tool.updated) directly from the agent's output. - Boundary markers: There are no documented delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The skill can perform network operations to the Feishu/Lark API and execute state changes within the interactive card UI.
- Sanitization: While the skill performs 'markdown-aware' splitting for display purposes, there is no evidence of sanitization to prevent the agent from obeying instructions embedded in the data it is processing.
Recommendations
- AI detected serious security threats
Audit Metadata