The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to use a 'One-Line Install' command (curl -fsSL https://raw.githubusercontent.com/outsourc-e/hermes-workspace/main/install.sh | bash) which downloads a script from an external repository and pipes it directly into the shell for execution. This practice allows for arbitrary remote code execution on the user's system without prior verification.
[EXTERNAL_DOWNLOADS]: The skill requires downloading source code and dependencies from a third-party GitHub repository (https://github.com/outsourc-e/hermes-workspace.git) that is not identified as a trusted vendor.
[COMMAND_EXECUTION]: The instructions rely heavily on shell commands to manage environment variables, service orchestration via pnpm and docker, and terminal session management using tmux for swarm mode. It specifically uses redirection (>> .env) to write sensitive configuration data like API tokens to local files.
[PRIVILEGE_ESCALATION]: The troubleshooting section includes commands that require elevated permissions, such as sudo ufw allow 8642/tcp, to modify system firewall settings.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect injection as it processes untrusted user data through its chat and API interfaces while maintaining extensive system access.
Ingestion points: Data enters the system via the 'Chat Interface' and custom API endpoints defined in the skill documentation.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between administrative commands and data provided by potentially untrusted external sources.
Capability inventory: The environment allows for subprocess spawning (pnpm, docker, tmux), file system modifications (writing to .env), and network requests via the fetch API.
Sanitization: The provided documentation lacks any evidence of input validation or sanitization procedures for data passed to the agent or integrated backend services.

hermes-workspace-ai-agent-ui