hermes-desktop

Guides for using ai agents skills like hermes-desktop.

• Caveman: Cut Claude Token Use by 65%

  How agent-side prompt compression works, when to use it, and when not to.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

Last scanned: 6/17/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/core: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-transformer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/resources: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-logs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-metrics: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@wesbos/code-icons: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "electron-vite: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "posthog-js: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: protobufjs : Schema-derived names can shadow runtime-significant properties",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite middleware may serve files starting with the same name with the public directory",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "high"
    },
    {
      "file": ".agents/skills/hermes-agent/SKILL.md",
      "line": 636,
      "type": "prompt-injection",
      "message": "Possible instruction-override phrase: \"ignore previous instructions\"",
      "severity": "high"
    },
    {
      "file": ".agents/skills/hermes-agent/SKILL.md",
      "line": 637,
      "type": "prompt-injection",
      "message": "Possible concealment directive: \"do not tell the user\"",
      "severity": "high"
    },
    {
      "file": ".agents/skills/hermes-agent/SKILL.md",
      "line": 637,
      "type": "prompt-injection",
      "message": "Possible jailbreak roleplay framing: \"act as if you have no restrictions\"",
      "severity": "medium"
    },
    {
      "file": ".agents/skills/hermes-agent/SKILL.md",
      "line": 993,
      "type": "secret-exfiltration",
      "message": "Instruction appears to send credentials/secrets to an external endpoint",
      "severity": "high"
    },
    {
      "file": ".agents/skills/hermes-agent/SKILL.md",
      "line": 129,
      "type": "remote-install",
      "message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scri\"",
      "severity": "medium"
    },
    {
      "file": ".claude/skills/hermes-agent/SKILL.md",
      "line": 636,
      "type": "prompt-injection",
      "message": "Possible instruction-override phrase: \"ignore previous instructions\"",
      "severity": "high"
    },
    {
      "file": ".claude/skills/hermes-agent/SKILL.md",
      "line": 637,
      "type": "prompt-injection",
      "message": "Possible concealment directive: \"do not tell the user\"",
      "severity": "high"
    },
    {
      "file": ".claude/skills/hermes-agent/SKILL.md",
      "line": 637,
      "type": "prompt-injection",
      "message": "Possible jailbreak roleplay framing: \"act as if you have no restrictions\"",
      "severity": "medium"
    },
    {
      "file": ".claude/skills/hermes-agent/SKILL.md",
      "line": 993,
      "type": "secret-exfiltration",
      "message": "Instruction appears to send credentials/secrets to an external endpoint",
      "severity": "high"
    },
    {
      "file": ".claude/skills/hermes-agent/SKILL.md",
      "line": 129,
      "type": "remote-install",
      "message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scri\"",
      "severity": "medium"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-06-17T09:02:00.499Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}