The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on the requests library for network communication. This is a standard and well-known dependency.
[COMMAND_EXECUTION]: The skill performs HTTP POST requests to an external API gateway (100.122.181.28) to execute delegated browsing and scraping tasks. This behavior is consistent with the skill's documented purpose.
[DATA_EXFILTRATION]: API credentials and the gateway URL are managed via environment variables (HERMES_API_KEY, HERMES_API_URL), which is the recommended practice for secret management. No unauthorized data transmission was detected.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as user-provided inputs (e.g., URLs, topics, field names) are interpolated into prompts sent to the downstream Hermes agent.
Ingestion points: Variables such as {url}, {fields}, and {topic} are sourced from user input in SKILL.md and the scrape function in scripts/hermes_api.py.
Boundary markers: The skill does not use specific delimiters or instructions to prevent the downstream agent from following instructions embedded within the user-provided data.
Capability inventory: The skill has the capability to perform network requests via requests.post and parse the results using json.loads in scripts/hermes_api.py.
Sanitization: No input validation or escaping is applied to user-controlled variables before they are included in the prompt string.

hermes-api-client