hermes-tweet
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from X/Twitter, such as mentions, search results, and account timelines. This introduces a surface for indirect prompt injection where malicious content in a tweet could attempt to influence the agent's behavior.
- Ingestion points: The
tweet_readtool retrieves external content from X/Twitter. - Capability inventory: The
tweet_actiontool provides capabilities for state-changing operations including posting tweets, sending DMs, and managing webhooks. - Sanitization/Mitigation: The skill enforces a strict "approval-gated" model. All state-changing operations require explicit operator confirmation of the exact endpoint, method, and payload before execution, significantly mitigating the risk of autonomous obedience to injected instructions.
- [COMMAND_EXECUTION]: The skill's setup instructions include a command to install the plugin via the Hermes Agent plugin manager (
hermes plugins install Xquik-dev/hermes-tweet). This is a standard and expected deployment mechanism for the platform. - [DATA_EXFILTRATION]: The skill utilizes an API key (
XQUIK_API_KEY) to authenticate with the Xquik service. The documentation correctly instructs the user to store this in environment variables and provides explicit warnings against including credentials in tool inputs or prompts.
Audit Metadata