hermes-in-buzz

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to load and follow the authoritative docs (https://hermes-agent.nousresearch.com/docs/integrations/buzz, https://hermes-agent.nousresearch.com/docs/user-guide/messaging/buzz, https://hermes-agent.nousresearch.com/docs/user-guide/features/acp) which control setup behavior, and also instructs cloning and building remote code from https://github.com/block/buzz.git (git clone + cargo build), which fetches and executes external source code—both are runtime external dependencies that affect agent instructions or execute code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running sudo commands and installing system services (e.g., sudo loginctl enable-linger and sudo hermes gateway install --system) and guides changes to persistence/service configuration and package installation, which modify machine state and require elevated privileges.