hermes-hudui-consciousness-monitor
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions direct the agent to clone source code from a third-party GitHub repository (
github.com/joeynyc/hermes-hudui.git). - [REMOTE_CODE_EXECUTION]: The quick start guide instructs the execution of a shell script (
./install.sh) immediately after downloading external code, which provides a path for remote code execution. - [COMMAND_EXECUTION]: The skill requires multiple high-privilege shell operations, including Python virtual environment creation (
python3.11 -m venv), package installation (pip install -e .), and Node.js build processes (npm install && npm run build). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display untrusted data from agent session logs, which presents a surface for indirect injection attacks.
- Ingestion points: Reads session data from
~/.hermes/sessions/and identity configuration from~/.hermes/identity.json(SKILL.md). - Boundary markers: The documentation mentions a "Safe Share Mode" for exports that redacts sensitive information, but no specific sanitization or boundary markers are described for the live monitoring and WebSocket data transmission.
- Capability inventory: The skill facilitates local file system reads across the entire
~/.hermes/directory and maintains an active WebSocket server for real-time data transmission. - Sanitization: While the export feature includes redaction logic, the core monitoring logic appears to trust the data stored in the agent's persistent memory and session logs.
Audit Metadata