hermes - 💡(How to fix) Fix Research disclosure: static review observations for agent-facing skill artifacts [1 participants]

Hello maintainers,

We are conducting a research study on repository-local agent instruction surfaces and recently analyzed this repository with agent-audit.

This is a static artifact review and should not be read as a claim of confirmed exploitation. We are sharing it because this repository combined moderate finding volume with several higher-signal artifact-backed structural patterns.

High-level scan summary:

• 96 raw findings
• 87 clustered issue instances
• 9 multi-signal issue instances
• 1 cross-tool issue instance

Review these files first:

1. skills/red-teaming/godmode/SKILL.md

   • canonical class: identity_rewrite_with_persistent_effect
   • rule: asamm.AI-04.persistent-identity-rewrite
   • why it stood out: identity-rewrite language plus persistent config/write-path cues in the same file

2. skills/research/research-paper-writing/SKILL.md

   • canonical class: autonomous_execution_or_looping
   • rule: asamm.AD-02.autonomous-loop-with-writes
   • why it stood out: autonomous workflow framing combined with write-action language

3. optional-skills/email/agentmail/SKILL.md

   • canonical class: broad_external_action_without_approval
   • rule: asamm.AD-02.broad-action-without-approval
   • why it stood out: external-action capability without clear per-action approval/scoping

4. skills/autonomous-ai-agents/claude-code/SKILL.md

   • canonical class: unsafe_command_or_execution_surface
   • rule: atr.privilege-escalation.shell-metacharacter-injection-in-tool-arguments
   • why it stood out: shell / command execution pattern

5. skills/autonomous-ai-agents/hermes-agent/SKILL.md

   • canonical class: remote_fetch_or_install_expands_trust_boundary
   • rule: aguara.external-download.curl-or-wget-piped-to-shell
   • why it stood out: remote fetch / install pattern associated with trust-boundary expansion

Questions that would help interpret these findings:

• Are these skills intended as operative defaults, optional power-user workflows, or red-team/reference content?
• Is persistence/approval logic intentionally documented outside the skill files themselves?
• Are some of the flagged artifacts intentionally adversarial or exploratory rather than intended for ordinary execution?

Method and dataset reference: https://github.com/scadastrangelove/agent-audit/tree/main/artifacts/article-support-dataset-v1

We would appreciate any maintainer context, especially for whether these files are meant to be operative defaults versus optional or demonstrative content.