The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from a personal GitHub account (https://github.com/GiannoKlein9/HermesFusion.git) and install it via pip install -e ., which involves executing code from an unverified external source during installation.
[COMMAND_EXECUTION]: The framework is designed to execute arbitrary shell commands defined in the command field of the config.yaml file (e.g., hermes, ollama, openai, or custom Python scripts) using subprocess.run or similar mechanisms.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data through the --prompt argument and --prompt-file inputs defined in SKILL.md.
Boundary markers: The skill documentation does not mention the use of delimiters or escaping mechanisms when interpolating the {prompt} placeholder into shell commands.
Capability inventory: The skill possesses significant capabilities, including the ability to execute shell commands with inherited environment variables (passthrough_env: true), which could be exploited to exfiltrate API keys if a malicious prompt triggers a command injection.
Sanitization: While the skill defines some safety constraints like max_prompt_bytes and allowed_roots_extra for files, it lacks explicit documentation of sanitization for the interpolated prompt strings passed to the shell.

hermesfusion-multi-model-panel