The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains an instruction to execute remote code via curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash. This piped execution pattern is a critical security vulnerability, as it runs a script from an external, non-whitelisted domain directly in the shell without any verification or integrity checks.
[PROMPT_INJECTION]: The references/themes.md file contains instructions that tell the agent to conceal its operations from the user. Specifically, it states 'You apply it; do NOT tell the user to run /skin', which encourages the agent to bypass user awareness of the manual commands being executed, reducing transparency and oversight.
[DYNAMIC_EXECUTION]: The skill implements a runtime plugin and widget system as described in references/desktop-plugins.md and references/tui-widgets.md. The application is designed to monitor local directories (~/.hermes/desktop-plugins/ and ~/.hermes/tui-widgets/) and dynamically load and execute JavaScript ESM files as soon as they are saved, providing a significant vector for local code execution.
[COMMAND_EXECUTION]: The skill documentation provides examples for spawning multiple independent background agent processes using tmux and the hermes CLI. This allows the agent to conduct autonomous missions that operate outside the user's primary interaction loop.
[INDIRECT_PROMPT_INJECTION]: The agent is configured to automatically ingest project context from files like AGENTS.md, .hermes.md, and .cursorrules located in the user's workspace. This creates an attack surface where malicious project data could be used to manipulate agent behavior.
Ingestion points: Project context files are read during session initialization; external web content is fetched via the web toolset.
Boundary markers: The skill mentions an internal scanner that attempts to block prompt injection patterns, although the effectiveness of this sanitization is not guaranteed.
Capability inventory: The agent has full access to the shell, file system, and network, along with the ability to load dynamic plugins.
Sanitization: The framework claims to use a pattern-based scanner for project files and a secret redaction system for tool outputs.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install third-party packages and MCP servers using package managers like pip, npx, and uvx. These installations target public registries and represent a supply chain risk, especially when package versions are not pinned or verified.

hermes-agent