The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's server-side logic in 'server/api/operatives/create.post.ts' uses the 'execAsync' function to create new agent profiles by shelling out to the Hermes CLI. The command string is constructed using unvalidated template literals ('${slug}', '${cloneFrom}'), allowing an attacker to perform shell command injection by providing malicious input to these fields.- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to download a compressed archive directly from an external GitHub repository ('https://github.com/Naroh091/hermes-war-room/releases/latest/download/hermes-war-room.tar.gz') and execute the extracted server code using Node.js.- [PROMPT_INJECTION]: The skill defines forceful behavioral constraints for orchestrator profiles using terms like 'CRITICAL RULES', 'MUST delegate', and 'NEVER answer directly' to override the model's default behavior and enforce the kanban-based workflow.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes data from external task summaries and profile files.
Ingestion points: Reads task status and summaries from '~~/.hermes/kanban.db' and profile instructions from '~~/.hermes/profiles/'.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore malicious commands embedded within task summaries or profile data.
Capability inventory: The skill has significant capabilities including file system access to the user's home directory, arbitrary shell execution via 'execAsync', and network communication through Server-Sent Events (SSE).
Sanitization: There is no evidence of input validation or sanitization for the content read from the kanban database or profile files before it is processed by the agent orchestration logic.

hermes-war-room-ui