hermes-action-loop-guard

• Outcome: Review
• Latest audit: Aug 11, 2026 · 10:56 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent with its Hermes repair purpose, but its installer makes persistent agent changes and has an unsafe rollback manifest path that can execute shell code.

Install only if you intentionally want this skill to patch a Hermes installation and change future agent behavior. Use dry-run first, keep backups protected from modification, and avoid rollback with any backup path you did not just create and verify. The rollback manifest parsing should be fixed before use in a sensitive or shared environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes operational steps that read environment state, inspect and modify files, and perform installs/rollbacks, but it declares no corresponding permissions. That mismatch weakens review and consent boundaries because users or orchestrators may authorize a seemingly limited diagnostic skill that can actually make persistent system changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to diagnose and repair Hermes action stalls, but the described behavior includes in-place source patching, configuration modification, service stop/restart, backup/rollback management, and runtime message injection. This is dangerous because the declared purpose understates privileged and potentially disruptive behavior, increasing the chance of unintended execution, persistence, service interruption, or unsafe changes to a production agent system.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The rollback path executes `source "$backup/manifest.env"`, which treats the backup manifest as shell code. If an attacker can modify the backup directory or trick a user into supplying a crafted backup path, arbitrary commands will run in the user's shell context during rollback.

Credential Access

High

• Category: Privilege Escalation

Content

restore_backup() {
  local backup="$1"
  test -n "$backup" || die "rollback requires --backup PATH"
  test -f "$backup/manifest.env" || die "invalid backup: no manifest.env"
  # shellcheck disable=SC1090
  source "$backup/manifest.env"
  test -f "$backup/config.yaml" || die "backup missing config.yaml"

• Confidence: 99% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

restore_backup() {
  local backup="$1"
  test -n "$backup" || die "rollback requires --backup PATH"
  test -f "$backup/manifest.env" || die "invalid backup: no manifest.env"
  # shellcheck disable=SC1090
  source "$backup/manifest.env"
  test -f "$backup/config.yaml" || die "backup missing config.yaml"

• Confidence: 99% confidence
• Finding: .env"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.