hermes-studio-dashboard
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a 'Web Terminal' feature that enables arbitrary shell command execution through Socket.IO 'terminal-input' events.\n- [EXTERNAL_DOWNLOADS]: The setup instructions require the installation of software from unverified third-party sources, specifically the 'hermes-web-ui' package via NPM and the 'ekkolearnai/hermes-studio' image via Docker Hub.\n- [CREDENTIALS_UNSAFE]: The documentation provides default administrative credentials ('admin' / '123456') and specifies that sensitive API tokens for platforms such as Telegram, Discord, and Slack are stored in local plain-text environment files like '~/.hermes/.env'.\n- [PERSISTENCE]: The skill includes functionality for creating and managing scheduled cron jobs, which can be used to execute automated tasks at recurring intervals.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture defines a significant vulnerability surface by ingesting data from multiple untrusted external communication platforms while granting the agent access to high-privilege capabilities such as a shell terminal and full file system access.\n
- Ingestion points: Incoming chat data from Telegram, Discord, Slack, WhatsApp, Matrix, Feishu, and WeCom integrations.\n
- Boundary markers: None identified in the provided documentation to delimit or sanitize external input.\n
- Capability inventory: Arbitrary shell command execution (Web Terminal), remote file system interaction (browse, upload, download, read, write), and outbound network communication.\n
- Sanitization: The documentation does not specify any validation or filtering mechanisms for content received from external platform integrations.
Audit Metadata