runbookhermes-aiops-agent
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to clone a complete codebase from an untrusted GitHub repository (
https://github.com/Tommy-yw/RunbookHermes.git). - [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands to set up the environment, including
git clone, dependency installation viapiporpoetry, and starting the API server usinguvicornandpython -m apps.runbook_api.main. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, including Loki logs, Jaeger traces, and Alertmanager webhooks. This data is compressed via the
EvidenceStackContextEnginefor model consumption, which creates a vulnerability to indirect prompt injection if malicious instructions are embedded in the observability data. - Ingestion points: Loki logs (
query_logs), Jaeger traces (query_traces), and Alertmanager webhooks (/gateway/alertmanager). - Boundary markers: Not explicitly mentioned in the documentation or code snippets.
- Capability inventory: The skill has significant capabilities including file system writes (
skill.save), network operations (API calls), and system remediation actions (execute_rollback). - Sanitization: The documentation does not specify any sanitization or filtering of the ingested observability data before it is passed to the context engine.
Audit Metadata