hermes-hudui-consciousness-monitor

Warn

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The installation instructions direct the agent to clone source code from a third-party GitHub repository (github.com/joeynyc/hermes-hudui.git).
  • [REMOTE_CODE_EXECUTION]: The quick start guide instructs the execution of a shell script (./install.sh) immediately after downloading external code, which provides a path for remote code execution.
  • [COMMAND_EXECUTION]: The skill requires multiple high-privilege shell operations, including Python virtual environment creation (python3.11 -m venv), package installation (pip install -e .), and Node.js build processes (npm install && npm run build).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display untrusted data from agent session logs, which presents a surface for indirect injection attacks.
  • Ingestion points: Reads session data from ~/.hermes/sessions/ and identity configuration from ~/.hermes/identity.json (SKILL.md).
  • Boundary markers: The documentation mentions a "Safe Share Mode" for exports that redacts sensitive information, but no specific sanitization or boundary markers are described for the live monitoring and WebSocket data transmission.
  • Capability inventory: The skill facilitates local file system reads across the entire ~/.hermes/ directory and maintains an active WebSocket server for real-time data transmission.
  • Sanitization: While the export feature includes redaction logic, the core monitoring logic appears to trust the data stored in the agent's persistent memory and session logs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 12, 2026, 06:49 PM
Security Audit — agent-trust-hub — hermes-hudui-consciousness-monitor