The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install plugin code from a non-trusted external repository (https://github.com/stainlu/hermes-labyrinth.git) using git clone.
[INDIRECT_PROMPT_INJECTION]: The plugin acts as a vulnerability surface by ingesting and processing untrusted data from the agent's journey traces (including tool outputs, prompt results, and crossing data) stored in state.db. \n * Ingestion points: Reads agent session data from ~/.hermes/state.db and configuration from ~/.hermes/cron/. \n * Boundary markers: Mentions escapeHtml for frontend display, but no specific prompt delimiters are described for the backend ingestion layer. \n * Capability inventory: Capable of reading the agent database, serving a local API for data access, and exporting data to the local file system. \n * Sanitization: Implements hermes.redactor.redact_secrets for exports and provides a fail-closed mechanism if redaction is unavailable.
[COMMAND_EXECUTION]: The installation process involves executing shell commands to create directories and clone code (mkdir -p, git clone). It also relies on curl for interacting with the local dashboard API.
[DATA_EXFILTRATION]: The skill accesses sensitive local files, specifically the state.db SQLite database which contains agent journey traces, prompts, and tool call history. While this is the intended purpose of the observability plugin, it represents an exposure of sensitive session information.

hermes-labyrinth-observability