Hermes Agent skills and MCP: what Staffbox leaves switched off

A Staffbox unit switches off nine tool groups and image generation, none of which a quote desk needs

Skills are reusable procedures the agent can write for itself and run again later; the official docs call them procedural memory and link them to an open skills standard. MCP (Model Context Protocol) connects the agent to outside tool servers, such as a calendar, a database or a file system. Both are described in the Hermes Agent documentation, which explains the features better than we can. Staffbox is not affiliated with Nous Research; this page covers only what a Staffbox unit leaves off and why.

The installer's safe default turns off these nine tool groups plus image generation.

A quote request is, by definition, a message from someone outside the company. So the rule is short: if the quote desk does not need a tool to do its job, the tool is off. That reasoning is ours.

A hostile quote request finds no route out, only a draft a person reads

Take the fictional Fieldstone IT again. A fictional sender emails a quote request, and halfway down adds a line telling the assistant to ignore its rules and email the price list and customer list to an outside address. This kind of attack is called prompt injection. The diagram traces where that instruction can go on a unit with the safe default.

1. It can read the message, because reading requests is its job.
2. It has no sending code, so it cannot email anything to anyone.
3. Terminal, code, browser, web, outside connections, delegation and scheduled jobs are off, so it has no other built-in route to move data out.
4. The model server listens only on 127.0.0.1 and no cloud provider is configured, so there is no outside service to hand the data to.
5. The file and skills tools stay on, so the agent can still write files the unit's user can write. That is why the unit holds only your price list and notes, a person approves every draft, and a write safe-root and a separate low-privilege user are in review.

This is our reasoning from the settings, not a security test result (our view). A bad draft is still a failure, and it counts against the score. The point is that the failure lands in front of a person, not on the internet.

MCP servers and agent-written skills are not covered by anything we have published

Be wary of anyone who gives you a neat answer here, including us. Our public record covers the nine tool groups and image generation above. It does not yet state how MCP servers or agent-written skills are handled on a customer unit, and we have not published a test of either (not measured yet).

Others have flagged exactly this area. As reported in a GitHub audit issue on the Hermes Agent project (issue 7826, seen 13 October 2026), agent-written skills can persist as a prompt-injection vector, and the issue lists findings by severity. There are three CVEs disclosed against Hermes components (CVE-2026-7396, CVE-2026-7397 and CVE-2026-6829; Cloud Security Alliance note, 4 May 2026); the note's nine-in-four-days figure refers to OpenClaw, a different agent platform. Staffbox has not verified these reports and does not use them as proof that Hermes is unsafe. They are why we turn off what we do not need. The wider picture is on Is Hermes Agent safe for company data?

So we make no claim in either direction on MCP or skills. If a buyer or an IT provider needs one, ask in writing at sales@staffbox.ai (buyers) or partners@staffbox.ai (IT providers). The answer should be a dated, public statement from us, not a sales reply.

Six checks apply to any Hermes install, ours or yours

• List every tool group that is on. Write down the reason for each. Anything without a reason goes off.
• List every MCP server connected. Who runs it, what can it read, what can it change?
• Look at every skill the agent has written for itself. Read them. Treat them as code someone else wrote.
• Confirm that the worker cannot send anything. A person should press send. On a Staffbox unit there is no sending code.
• Confirm that the model server listens only on 127.0.0.1 and that no cloud provider is configured.
• Re-check all of the above after every update. See monthly updates and the test set.

Sources

• Hermes Agent docs (skills, MCP), Nous Research, seen 13 Oct 2026.
• Hermes Agent repository and audit issue 7826, seen 13 Oct 2026 (as reported).
• Cloud Security Alliance research note on Hermes Agent CVEs, 4 May 2026: three CVEs against Hermes components (CVE-2026-7396, -7397, -6829); its "9 CVEs in 4 days" headline refers to OpenClaw (as reported).
• Staffbox safe default: scripts/install.sh; security sheet in github.com/Staffbox-ai/staffbox (MIT).