collaborating-with-hermes

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is scripts/hermes_bridge.py → run_hermes() executes the external hermes process and captures its stdout (completed.stdout) and then includes it in the returned JSON as agent_messages/artifact/handoff, so any free-form content produced by Hermes (an outsider provider’s output) can flow into the agent LLM context; this is an “outsider-authored free text” category via provider response ingestion.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly allows and instructs running Hermes with execution rights (e.g., --worktree and an authorized direct-execution flow), and even mandates adding --ignore-rules (bypassing project safeguards), which enables modification of the workspace and therefore can change the machine state.