Project Methodology

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.0.1

Overview

This skill is a project workflow helper, but it asks the agent to inspect/index beyond the current project and run an unmanaged local script, so users should review its scope before installing.

Install only if you are comfortable with a workflow that may look across multiple local projects and invoke an existing ~/.hermes indexer. Before use, narrow triggers, restrict discovery/indexing to the current repository unless you explicitly approve named directories, and require confirmation before any production, database, API, or external-script action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:442

Finding

Unrestricted Cross-Project Discovery and Execution of an External Indexer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94, SKILL.md:263, SKILL.md:406, SKILL.md:442-444, and SKILL.md:505-506
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

bash

python3 ~/.hermes/scripts/project-knowledge-index.py doctor 2>/dev/null | head -10

markdown

1. **Scan sibling projects** for existing patterns first

bash

python3 ~/.hermes/scripts/project-knowledge-index.py index 2>/dev/null

bash

# Find project root
find ~ -maxdepth 5 -name "CLAUDE.md" 2>/dev/null | head -5
search_files(path="~", pattern="CLAUDE.md", limit=10)
search_files(path="~", pattern="PROJECT.md", limit=10)

markdown

5. **Missing project discovery** — scan all projects before claiming an
   incomplete portfolio picture.

Technical Analysis

The skill instructs the agent to search the user's home directory, inspect sibling or all projects, and execute project-knowledge-index.py from outside the audited package. These operations exceed the least-privilege scope normally required to manage the current project.

Searching from ~ can reveal unrelated repositories and project-memory files. Scanning sibling projects can then expose their internal instructions, architecture, business context, and other sensitive metadata to the current session. The skill also states that cross-project knowledge becomes available, indicating that discovered information may be aggregated rather than used only for locating the active repository.

The external indexer presents an additional trust-boundary issue. Its implementation is not included in the audited artifact, and the path under ~/.hermes/scripts/ is mutable local code. Consequently, the reviewed skill cannot guarantee which files the script reads, how indexed information is stored, or what behavior occurs when the script is invoked.

No evidence was found that the skill transmits collected information externally, install ...[truncated 1582 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all default discovery to the current repository root rather than the user's home directory.
2. Replace home-directory searches with repository-scoped commands, such as:

   bash

   find . -maxdepth 3 \( -name "CLAUDE.md" -o -name "PROJECT.md" \)
   

3. Remove the requirements to “scan sibling projects” and “scan all projects.” Make cross-project inspection optional and require explicit, current-turn user approval identifying the permitted directories.
4. Apply a canonical-path allowlist before reading files so symlinks or relative paths cannot escape the approved repository.
5. Do not execute ~/.hermes/scripts/project-knowledge-index.py automatically. Require explicit approval and clearly disclose the script path and intended scope.
6. Prefer a vendored, version-pinned, reviewed indexer whose implementation is included in the package. If an external indexer remains necessary, validate its integrity and configure it with an explicit repository allowlist.
7. Exclude credential files, local environment files, secret-bearing paths, unrelated repositories, and ignored files from indexing.
8. Display the files selected for indexing and obtain confirmation before processing them.
9. Document where indexed data is stored, its retention period, and how users can inspect or delete it.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 83% confidence

Finding

The trigger phrase 'close out' overlaps semantically with built-in close/termination commands and can shadow or confuse command routing. In this skill, that could cause unintended wrapup behavior, including filesystem inspection and document updates, when the user may only be trying to end a conversation or invoke a different command.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list uses broad natural-language and regex-like patterns such as 'what.*open', 'we.*done', and 'init.*project', making accidental activation likely during ordinary conversation. Unintended activation matters here because the skill performs file reads, git inspection, file writes, and external-script suggestions, so a casual phrase could launch higher-risk workflow steps without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs cross-environment checks against staging and production during normal build work, which can prompt an agent to access live systems even when not strictly necessary. Although it says production operations require explicit approval, normalizing production inspection as part of the default workflow increases the chance of unintended sensitive access, accidental disclosure of live data, or unsafe context switching.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes operational guidance for live data-script execution and destructive database actions, which creates a pathway for an agent to participate in hazardous production-affecting workflows. Even with approval language, embedding these actions in the methodology increases the likelihood that an agent will prepare or facilitate risky commands that could cause data loss or unauthorized modification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The wrapup stage executes an external script from the user's home directory, which is outside the skill's trusted contents and can be modified independently. This creates a code-execution boundary violation: invoking an unmanaged local script can run arbitrary commands, exfiltrate data, or alter project state under the guise of routine indexing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/stale-data-verification.md (reported line 18)May include surrounding context.

md

## ⚠️ Data Source Safety

**Direct database queries (via CLI, Prisma, curl, etc.) require explicit user approval in the current turn.** Never run queries against production databases without confirmation. Prefer:

- **git log** — commit messages tell you what shipped
- **Application API endpoints** — use existing routes (e.g., `/api/admin/stats`)

Static analysis

No suspicious patterns detected.