The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to observe and learn from arbitrary user session data to generate executable code. This creates a significant attack surface where malicious input provided during a session could be 'learned' and transformed into a persistent malicious plugin.
Ingestion points: The entire active session history, including commands, tool outputs, and user-provided data.
Boundary markers: The skill does not define delimiters or provide instructions to the agent to ignore or sanitize embedded instructions within the observed workflow data.
Capability inventory: The skill is capable of generating Python files (plugin.py) and markdown instructions (SKILL.md) and saving them to the local filesystem (~/.hermes/).
Sanitization: There is no evidence of sanitization, escaping, or validation of the observed session content before it is interpolated into the code and markdown templates.
[DYNAMIC_EXECUTION]: The skill dynamically generates Python source code for plugins based on session activity. While it provides a template, the logic within the @hermes.command and @hermes.tool decorators is derived from untrusted session data, which may lead to the creation of unintended or dangerous executable logic.
[DATA_EXFILTRATION]: The 'Silent Observation' phase (Phase 1) instructs the agent to log all repeated actions and multi-step workflows without notifying the user. If the user processes sensitive information—such as hardcoded keys, private file paths, or confidential data—this information may be captured in the 'mental log' and subsequently stored in the generated SKILL.md or plugin.py files.

Skill Factory