ClawHub
Back to skill

Security audit

Hermes Share

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate sharing purpose, but it asks agents to upload skill archives to third-party hosts and install downloaded archives by running unverified shell code.

Install only if you trust the sender and are comfortable with skill archives being uploaded to public temporary file hosts. Before using the receiving workflow, inspect the ZIP and install.sh, verify included files, and avoid installing archives from unsolicited or untrusted links.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:81
Finding

Unverified Skill Archive Executes Attacker-Controlled Installer

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:81-87
Vulnerability Type: Unverified remote payload execution
Risk Level: Critical

Vulnerable Code

bash
# ١. تأكد من وجود الملف
ls ~/Downloads/xxx.zip

# ٢. فك الملف
unzip -o ~/Downloads/xxx.zip -d ~/Downloads/hermes-skills-temp/

# ٣. شغّل التثبيت
bash ~/Downloads/hermes-skills-temp/install.sh

Technical Analysis

The receiving workflow extracts an externally supplied ZIP archive and immediately executes the install.sh file contained in that archive. Checking that the ZIP exists does not establish its authenticity or integrity.

The workflow does not perform any of the following controls:

  • Cryptographic signature verification
  • Trusted publisher validation
  • Checksum verification against a trusted manifest
  • Validation that install.sh matches the installer shipped by this project
  • Static inspection of the shell script
  • Sandboxed execution
  • User confirmation after displaying the commands that will run

Consequently, anyone who can convince a recipient to download or save a crafted archive can provide an arbitrary shell payload. Temporary download links further separate the reviewed instructions from the payload eventually retrieved by the recipient.

Attack Path

  1. An attacker creates a ZIP archive containing an apparently valid Skill directory and a malicious root-level install.sh.
  2. The attacker distributes the archive directly or through a temporary download URL.
  3. The recipient asks the Hermes agent to install the archive using the documented prompt.
  4. The agent extracts the archive into ~/Downloads/hermes-skills-temp/.
  5. The agent runs the archive-controlled install.sh without verifying it.
  6. The malicious script executes with all privileges available to the recipient's user account.

Impact Assessment

Successful exploitation provides arbitrary command execution under the recipient agen ...[truncated 403 chars]

Remediation
View remediation

Remediation Suggestions

  • Never execute an installer supplied by the incoming archive.
  • Keep the installer as trusted local code and use it only to process validated Skill data files.
  • Require a signed manifest containing the publisher identity, archive digest, allowed paths, and digest of every packaged file.
  • Verify signatures and hashes before extraction or installation.
  • Extract into a newly created private directory and reject absolute paths, traversal components, symlinks, hard links, devices, and other special files.
  • Present the validated file list and requested changes to the user before installation.
  • If execution is unavoidable, run it in a restricted sandbox without credentials, network access, or write access outside a dedicated staging directory.
  • Delete the staging directory safely after installation.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pack_skills.py:60
Finding

Incomplete Secret Filtering and Symlink Following Can Expose Sensitive Files

Content
View full analysis

Vulnerability Details

File Location: scripts/pack_skills.py:60-64, 226-244, 307-319
Vulnerability Type: Sensitive-data exposure through ineffective sanitization and unsafe archive creation
Risk Level: High

Vulnerable Code

python
API_KEY_PATTERNS = [
    r'(?:api[_-]?key|apikey|secret|token|password)\s*[:=]\s*["\']?[\w\-\.]{20,}["\']?',
    r'sk-[a-zA-Z0-9]{32,}',
    r'[A-Za-z0-9+/]{40,}={0,2}',
]
python
def should_exclude(file_path: str) -> bool:
    """Check whether a file should be excluded."""
    name = os.path.basename(file_path)

    parts = Path(file_path).parts
    for part in parts:
        if part in EXCLUDE_DIRS:
            return True

    for pattern in ALWAYS_EXCLUDE:
        if Path(name).match(pattern):
            return True

    if name.startswith(".env"):
        return True

    return False
python
for skill_path in skill_paths:
    skill_name = skill_path.name
    for root, dirs, files in os.walk(skill_path):
        dirs[:] = [d for d in dirs if d not in EXCLUDE_DIRS]
        for f in files:
            fpath = os.path.join(root, f)
            if should_exclude(fpath):
                continue
            arcname = os.path.join(
                skill_name, os.path.relpath(fpath, skill_path)
            )
            zf.write(fpath, arcname)

Technical Analysis

API_KEY_PATTERNS defines patterns for identifying credentials, but no packaging path applies those patterns to file contents. should_exclude() only evaluates file names and path components. Secrets embedded in ordinary files such as config.py, settings.json, documentation, shell scripts, or source code therefore remain eligible for packaging.

Archive creation also does not reject symbolic links or resolve each source path and verify that it remains inside the selected Skill directory. Python's ZIP-writing behavior can dereference a file ...[truncated 1799 chars]

Remediation
View remediation

Remediation Suggestions

  • Reject all symbolic links, hard links, sockets, devices, FIFOs, and other non-regular files.
  • Resolve every candidate source path with Path.resolve() and verify that it is strictly beneath the canonical selected Skill directory.
  • Open files safely after validation and guard against time-of-check/time-of-use replacement.
  • Apply credential detection to actual file contents before packaging.
  • Prefer a strict extension and path allowlist rather than relying only on a denylist.
  • Add common credential and private-data formats to the scanner, while treating scanning as defense in depth rather than a guarantee.
  • Generate a manifest showing every included and excluded file for user review.
  • Abort packaging when a potential secret is found unless the user explicitly removes or replaces it.
  • Add regression tests for embedded credentials, symlinks targeting external files, broken links, nested links, and race conditions.
  • Remove absolute claims such as “No API keys or sensitive data included” unless independently verified.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:190
Finding

Mandatory Upload Sends Skill Archives to Unauthenticated Third-Party File Hosts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:190-220
Vulnerability Type: Unnecessary external disclosure of packaged data
Risk Level: High

Vulnerable Code

markdown
### المرحلة ٣: الإرسال (ملف مباشر + رابط مؤقت — الثنين مع بعض)

**⚠️ القاعدة:** كل مشاركة لازم توفر **الملف المباشر + الرابط المؤقت** — ما نسأل المستخدم يختار. دايم الثنين.
bash
# ١. tmpfiles.org (الأسرع — استخدمه أول دايم)
curl -s -F "file=@~/Downloads/hermes-skills-share.zip" https://tmpfiles.org/api/v1/upload

# ٢. إذا فشل: file.io
curl -s -F "file=@~/Downloads/hermes-skills-share.zip" https://file.io

# ٣. إذا فشل: transfer.sh
curl --upload-file ~/Downloads/hermes-skills-share.zip https://transfer.sh/hermes-skills-$(date +%Y%m%d).zip

Technical Analysis

The instructions require every sharing operation to produce both a direct attachment and a temporary public-hosted link, explicitly stating that the user should not be asked to choose. This sends the complete archive across an additional trust boundary even when direct attachment is sufficient.

The listed upload commands do not provide client-side encryption, recipient authentication, access-control configuration, integrity metadata, or independently enforced deletion. Anyone who obtains or guesses a valid link may be able to retrieve the archive according to the service's behavior.

The risk is amplified by the incomplete secret filtering in pack_skills.py. The external upload may therefore contain credentials or confidential code despite the template's assurance that the package has been sanitized.

Attack Path

  1. A user asks to share one or more Skills with a recipient.
  2. The packager creates an archive that may include sensitive content missed by name-based filtering.
  3. The workflow attaches the archive directly as requested.
  4. Without obtaining separate upload consent, the workflow also sends the archive to tmpfiles.org, file.io, or `tr ...[truncated 760 chars]
Remediation
View remediation

Remediation Suggestions

  • Default to local archive creation and direct attachment only.
  • Treat third-party upload as a separate, explicit opt-in action.
  • Display the selected service, privacy implications, retention behavior, archive size, and complete file manifest before requesting confirmation.
  • Support client-side authenticated encryption so the hosting provider receives only ciphertext.
  • Communicate the decryption key through a separate trusted channel.
  • Prefer authenticated storage with recipient-specific access controls and revocation.
  • Verify the archive locally for secrets and unsafe file types before any transmission.
  • Avoid automatic fallback between providers because each fallback introduces a new data processor.
  • Clearly state that expiration and deletion depend on the external provider and cannot be guaranteed by this Skill.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/install_skills.sh:66
Finding

Untrusted Category Metadata Allows Installation Outside the Hermes Skills Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/install_skills.sh:66-78
Vulnerability Type: Path traversal through unvalidated destination metadata
Risk Level: High

Vulnerable Code

bash
skill_md="$skill_dir/SKILL.md"
category=""
if [[ -f "$skill_md" ]]; then
    # Attempt to extract the category from SKILL.md
    category_line=$(head -20 "$skill_md" | grep -i "category:" | head -1 || true)
    if [[ -n "$category_line" ]]; then
        category=$(echo "$category_line" | sed 's/.*category:[[:space:]]*//i' | xargs)
    fi
fi

if [[ -n "$category" && "$category" != "general" ]]; then
    target="$HERMES_SKILLS/$category/$skill_name"
fi

echo -e "Installing $skill_name..."
mkdir -p "$(dirname "$target")"
cp -r "$skill_dir" "$target"

Technical Analysis

The installer derives category from the incoming Skill's untrusted SKILL.md. It concatenates that value directly into the destination path without enforcing a safe identifier format or verifying the canonical result remains under $HERMES_SKILLS.

A category containing traversal components such as ../../some/path causes path normalization by the filesystem to escape the intended Hermes Skills directory. An absolute-looking or specially structured value may produce additional unexpected destination behavior depending on the final concatenated path.

Quoting prevents shell word splitting and command substitution at execution time, but it does not prevent filesystem path traversal. The mkdir -p and cp -r commands then create and populate the escaped destination.

Attack Path

  1. An attacker creates a Skill with a valid SKILL.md.
  2. The first 20 lines contain a category value with traversal components, for example category: ../../.config/attacker.
  3. The archive passes the installer's minimal requirement that the directory contain SKILL.md.
  4. The installer extracts the category and constructs: `ta ...[truncated 834 chars]
Remediation
View remediation

Remediation Suggestions

  • Restrict categories to a conservative identifier pattern such as ^[A-Za-z0-9_-]+$.
  • Reject empty components, dots, .., slashes, backslashes, control characters, and absolute paths.
  • Parse YAML with a safe parser rather than extracting metadata using grep, sed, and xargs.
  • Resolve the complete destination to a canonical path before creating directories.
  • Verify that the resolved destination is strictly beneath the canonical $HERMES_SKILLS directory.
  • Reject the installation if containment cannot be proven.
  • Use a fixed trusted mapping from known category names to destination directories where possible.
  • Check every parent component for symbolic links before writing.
  • Create destination directories with restrictive permissions and fail if the destination already exists.
  • Add tests covering ../, repeated traversal, encoded separators, whitespace, control characters, absolute paths, and symlinked parent directories.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior mixes packaging, README generation, local installation, and upload instructions, while the declared purpose emphasizes transfer/link generation. This ambiguity can cause automated systems or users to approve the skill under incomplete assumptions, which is a security problem in agent ecosystems where declarative metadata guides trust decisions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documented behavior mixes packaging, README generation, local installation, and upload instructions, while the declared purpose emphasizes transfer/link generation. This ambiguity can cause automated systems or users to approve the skill under incomplete assumptions, which is a security problem in agent ecosystems where declarative metadata guides trust decisions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

hermes skills list | grep اسم-المهارة

٥. نظف

rm -rf ~/Downloads/hermes-skills-temp/

text

ثم أخبر المستخدم **بلغته**:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

hermes skills list | grep اسم-المهارة

٥. نظف

rm -rf ~/Downloads/hermes-skills-temp/

text

ثم أخبر المستخدم **بلغته**:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
**⚠️ مهم:** قبل حزم المهارات، اقرأ ملف `SKILL.md` لكل مهارة مطلوبة لتوليد شرح بلغة المرسِل.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md
**⚠️ مهم:** قبل حزم المهارات، اقرأ ملف `SKILL.md` لكل مهارة مطلوبة لتوليد شرح بلغة المرسِل.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md
| `scripts/pack_skills.py` | حزم المهارات في ZIP مع تنظيف تلقائي للبيانات الحساسة |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
| `scripts/pack_skills.py` | حزم المهارات في ZIP مع تنظيف تلقائي للبيانات الحساسة |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 503)May include surrounding context.

md
| `scripts/pack_skills.py` | حزم المهارات في ZIP مع تنظيف تلقائي للبيانات الحساسة |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

unzip -l /tmp/test-pack.zip

٤. تنظيف

rm /tmp/test-pack.zip

text

---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pack_skills.py (reported line 36)May include surrounding context.

python
# ملفات/مجلدات مستبعدة دائماً
ALWAYS_EXCLUDE = [
    ".env",
    ".env.*",
    "*.key",
    "*.pem",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pack_skills.py (reported line 240)May include surrounding context.

python
# ملفات/مجلدات مستبعدة دائماً
ALWAYS_EXCLUDE = [
    ".env",
    ".env.*",
    "*.key",
    "*.pem",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 512)May include surrounding context.

md
"*.key",
    "*.pem",
    "*.token",
    "credentials.json",
    "auth.json",
    "secrets",
]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/pack_skills.py (reported line 41)May include surrounding context.

python
"*.key",
    "*.pem",
    "*.token",
    "credentials.json",
    "auth.json",
    "secrets",
]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill declares broad capabilities to read/write files and inspect environment-adjacent paths but does not define any explicit tool scope or permission boundaries. In an agent setting, missing scope makes it easier for the skill to be invoked with more authority than intended and increases the blast radius if its instructions are abused or misinterpreted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger definitions are broad enough to activate on vague requests related to transfer or installation. In an agent context, overly permissive triggers increase the chance of accidental invocation of packaging, upload, extraction, or installation workflows on ambiguous user input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The receiving-side trigger accepts any similar phrasing in any language as long as a ZIP path is 'clear,' which is too open-ended for a workflow that unzips archives and runs bash install.sh. Broad multilingual matching around code-executing operations raises the risk of prompt confusion, accidental execution, or social engineering with attacker-supplied archives.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow directs the agent to read each selected skill's SKILL.md and generate/share descriptive content from it. Because SKILL.md is treated as untrusted input and may contain embedded sensitive text or adversarial instructions, this can leak unintended content into the generated README or outbound share package.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill explicitly instructs uploading a locally created ZIP archive to third-party file-sharing services. Even if intended for legitimate sharing, external transmission of packaged skills can leak proprietary prompts, embedded secrets missed by sanitization, or other sensitive local content to untrusted infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

md
# MEDIA:/Users/abdurrahmanjahfali/Downloads/hermes-skills-share.zip

# ٤. رابط مؤقت (في نفس الوقت)
curl -s -F "file=@~/Downloads/hermes-skills-share.zip" https://tmpfiles.org/api/v1/upload
# استخرج الرابط من الناتج وحوّله لصيغة التحميل المباشر:
# https://tmpfiles.org/dl/XXXXXX/hermes-skills-share.zip

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The security disclaimer says uploads occur only on explicit user request, but the workflow states that every share must include an external temporary link. That contradiction normalizes exfiltration to third-party services and can lead users to disclose local skill contents externally without a fresh, informed consent decision.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L26 states 'English always' and requires the description field to be in English. This is a natural-language policy concern because it forces a specific language choice rather than offering language selection or documenting a justified regional requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Several visible instructional comments and status messages are written only in Arabic, which effectively forces a specific language for users of the installer. The policy allows locale constraints only when they are justified or when users are given a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code presents CLI help text in Arabic and generates installer/status strings in Arabic-only or Arabic-first form, which imposes a specific language/locale on users. The policy allows locale constraints only when explicitly justified or when the user is given a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template instructs recipients to install a skill directly from a downloaded ZIP in ~/Downloads without any explicit warning to verify the sender, inspect the package contents, or consider the risks of installing untrusted code. In the context of peer-to-peer skill sharing, this increases the likelihood of social engineering and unsafe installation of malicious skills, especially because the message language reassures the user that installation and verification are handled automatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation describes recipient impact narrowly as copying only to a single fixed path. The embedded installer derives a category from each packaged skill's SKILL.md and writes to ~/.hermes/skills/$category/$skill_name, so the actual destination is dynamic within the Hermes skills tree rather than the exact single path stated.

Content

No source excerpt is available for this finding.