The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to spawn and communicate with external processes using the stdio transport. Users are instructed to configure executables (e.g., npx, uvx) and arguments in ~/.hermes/config.yaml, which are then executed by the agent as long-lived subprocesses.
[EXTERNAL_DOWNLOADS]: The documentation promotes the use of npx and uvx for running MCP servers. These tools typically download packages from public registries (npm, PyPI) and execute them immediately, introducing a dependency on external, third-party code at runtime.
[INDIRECT_PROMPT_INJECTION]: By integrating external tool outputs into the agent's context, the skill introduces a surface for indirect prompt injection. If an MCP server returns data containing malicious instructions, the agent might inadvertently execute them.
Ingestion points: External tool results from configured MCP servers are registered as mcp_* tools and their outputs are directly ingested into the agent's conversation context.
Boundary markers: The documentation mentions credential stripping in error messages but does not specify the use of delimiters or explicit "ignore embedded instructions" warnings for general tool output processing.
Capability inventory: The agent has access to powerful system tools (such as terminal and read_file) alongside any capabilities provided by the configured MCP servers (e.g., filesystem access, GitHub integration).
Sanitization: Credential redaction is performed on error messages, but the skill does not describe general content sanitization or validation for tool outputs.
[DYNAMIC_EXECUTION]: The skill supports the sampling/createMessage capability, allowing external MCP servers to initiate LLM requests through the agent. This enables server-initiated workflows and potentially multi-turn tool loops (max_tool_rounds), which could lead to unintended recursive tool execution if not carefully monitored.

native-mcp