AideNote for Hermes

• Outcome: Review
• Latest audit: Jul 22, 2026 · 7:38 AM UTC
• Version: 1.2.9

Overview

The skill appears purpose-built for AideNote, but it can query sensitive account data on broad productivity prompts and install persistent local services, so users should review it carefully before installing.

Install only if you want Hermes/OpenClaw to access your real AideNote recordings, transcripts, summaries, todos, knowledge bases, and to set up local startup services for the mobile bridge. Use install or repair commands only after you explicitly intend those local changes, and treat generic meeting/task questions as potentially able to query AideNote data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise BridgeError("powershell_missing", "PowerShell is required to install the AideNote bridge.")
        command = [powershell, "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", str(installer)]
    try:
        completed = subprocess.run(
            command,
            env=installer_environment,
            capture_output=True,

• Confidence: 91% confidence
• Finding: The code downloads an installer script from the network and then executes it with bash or PowerShell, granting it access to sensitive environment variables including the API key. Although the download is HTTPS-protected and hash-verified, this still creates a high-trust remote code execution path: compromise of the release process, incorrect hash maintenance, or malicious installer behavior would immediately lead to code execution and credential exposure on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise BridgeError("powershell_missing", "PowerShell is required to install the AideNote bridge.")
        command = [powershell, "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", str(installer)]
    try:
        completed = subprocess.run(
            command,
            env=installer_environment,
            capture_output=True,

• Confidence: 80% confidence
• Finding: The code downloads an external installer script and executes it locally with Bash or PowerShell. Although it verifies a pinned SHA-256 before execution, this still creates a high-risk trust boundary: compromise of the hardcoded hash update process, installer hosting pipeline, or local interpreter resolution could result in arbitrary code execution with the user's privileges. In an agent skill that installs persistence mechanisms and local services, that execution path is especially sensitive.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs execution of shell commands, use of local scripts, network downloads, environment-variable expansion, and installation/repair actions, yet it declares no permissions. This mismatch is dangerous because users and enforcement systems may not understand that the skill can read local state, modify configuration, invoke installers, and communicate over the network.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill expands beyond querying AideNote data and authorized bridge installation into managing the Hermes gateway service (`status`, `start`, and forced reinstall). That increases the skill's operational scope and can trigger system changes to local services that a user may not have intended when asking about AideNote, creating risk of unauthorized service modification or persistence-related changes.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger text is overly broad and covers common requests like meetings, summaries, and tasks, which could cause the skill to activate in situations where the user did not intend AideNote access. In context, that matters because activation leads to querying real account data and potentially initiating local connection setup workflows.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The manifest description contains very broad trigger phrases such as meeting minutes, transcripts, summaries, today's tasks, and action items, which can cause the skill to activate for ordinary productivity requests. Over-broad activation is dangerous here because the skill is capable of installing software, checking account state, and interacting with local bridge components, so unintended invocation may lead to unnecessary command execution or disclosure of sensitive AideNote-derived data.

Credential Access

High

• Category: Privilege Escalation

Content

def write_pairing_credentials(api_key: str) -> None:
    write_private_json(
        hermes_home() / "aidenote-credentials.json",
        {"apiBase": "https://api.aidenote.cn", "apiKey": api_key},
    )

• Confidence: 88% confidence
• Finding: The code persists the API key in a local JSON file under the user's home directory. While permissions are restricted on non-Windows systems, plaintext storage of long-lived credentials increases exposure to local malware, backups, accidental disclosure, and weaker Windows ACL handling because no platform-specific secure store is used.

Credential Access

High

• Category: Privilege Escalation

Content

def write_pairing_credentials(api_key: str) -> None:
    write_private_json(
        hermes_home() / "aidenote-credentials.json",
        {"apiBase": "https://api.aidenote.cn", "apiKey": api_key},
    )

• Confidence: 72% confidence
• Finding: The pairing worker receives an API key from the remote service and persists it in a plaintext JSON file under the Hermes home directory. While file permissions are tightened on non-Windows systems, plaintext at-rest storage of an API credential increases theft risk from local compromise, backup leakage, or multi-user misconfiguration; in this skill, that credential enables access to AideNote data and service installation flows.

Session Persistence

Medium

• Category: Rogue Agent

Content

install_dir = home / "Library" / "Application Support" / "AideNote" / "OpenClawBridge"
        tunnel_binary = install_dir / "aide-note-tunnel"
        workbuddy_binary = install_dir / "aidenote-workbuddy-bridge"
        tunnel_service = home / "Library" / "LaunchAgents" / "cn.aidenote.openclaw-tunnel.plist"
        workbuddy_service = home / "Library" / "LaunchAgents" / "cn.aidenote.workbuddy-bridge.plist"
        hermes_service = home / "Library" / "LaunchAgents" / "ai.hermes.gateway.plist"
    elif system == "Windows":

• Confidence: 86% confidence
• Finding: The skill installs or relies on LaunchAgent persistence for a tunnel component so it starts automatically at login. In this skill context that persistence is part of the product's intended function, but persistence mechanisms materially increase risk because compromise of the installed component would survive reboots and maintain continued access.

Session Persistence

Medium

• Category: Rogue Agent

Content

tunnel_binary = install_dir / "aide-note-tunnel"
        workbuddy_binary = install_dir / "aidenote-workbuddy-bridge"
        tunnel_service = home / "Library" / "LaunchAgents" / "cn.aidenote.openclaw-tunnel.plist"
        workbuddy_service = home / "Library" / "LaunchAgents" / "cn.aidenote.workbuddy-bridge.plist"
        hermes_service = home / "Library" / "LaunchAgents" / "ai.hermes.gateway.plist"
    elif system == "Windows":
        install_dir = home / "AppData" / "Local" / "AideNote" / "OpenClawBridge"

• Confidence: 86% confidence
• Finding: This LaunchAgent entry enables automatic startup for the workbuddy bridge. Even if legitimate, auto-start persistence broadens the blast radius of any bug or compromise in that bridge by ensuring repeated execution across sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

workbuddy_binary = install_dir / "aidenote-workbuddy-bridge"
        tunnel_service = home / "Library" / "LaunchAgents" / "cn.aidenote.openclaw-tunnel.plist"
        workbuddy_service = home / "Library" / "LaunchAgents" / "cn.aidenote.workbuddy-bridge.plist"
        hermes_service = home / "Library" / "LaunchAgents" / "ai.hermes.gateway.plist"
    elif system == "Windows":
        install_dir = home / "AppData" / "Local" / "AideNote" / "OpenClawBridge"
        tunnel_binary = install_dir / "aide-note-tunnel.exe"

• Confidence: 83% confidence
• Finding: The Hermes gateway LaunchAgent indicates another automatic-start persistence point. Multiple persisted components increase attack surface and make post-compromise cleanup harder, especially for a skill whose role is to connect local services and external accounts.

VirusTotal

53/53 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.