Education

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

The education skill is mostly documentation-only, but it directs users to install a broad, unpinned external multi-skill ecosystem with capabilities beyond the stated education purpose.

Use the standalone education skill only after confirming how it handles student data. Do not install the recommended full ecosystem unless you have reviewed the external package manifest, permissions, source, version pinning, and data-sharing behavior, especially memory sharing, publishing, and orchestration features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:66

Finding

Unpinned External Ecosystem Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66–81
Vulnerability Type: Unpinned and unaudited third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

## 🔗 Swarm Ecosystem Integration
This skill is part of the ClawHub Swarm Ecosystem. For multi-agent orchestration, combine with:
- **SellingSkills Master Installer** — Unified 21-skill ecosystem manifest
- **masterswarm** — Central swarm controller
- **agent-swarm-workflow** — Declarative workflow engine
- **clawhub-memory-tiers-pro** — Cross-agent memory sharing
- **swarmwage-publish** — Content monetization pipeline
- **bountyswarm** — Automated bounty marketplace

Install the full ecosystem: `hermes skills install @andrew-myers/selling-skills`

Technical Analysis

The project directs users to install an external 21-skill bundle using a mutable package identifier. The command does not pin an exact version or immutable digest, provide an integrity checksum, identify a reviewable source repository, disclose requested permissions, or include the installed manifest for auditing.

The recommended bundle also includes capabilities beyond the documented education use case, such as central agent orchestration, cross-agent memory sharing, publication and monetization pipelines, and an automated bounty marketplace. Installing this broad dependency bundle increases the attack surface and violates least-dependency principles.

Because the external package is not included in the audited project, its behavior cannot be verified from the available source. There is no evidence in SKILL.md proving that the dependency is currently malicious; the vulnerability is the unsafe, unpinned supply-chain installation mechanism and the absence of controls that would prevent a compromised or subsequently modified release from being installed.

Attack Path

1. A user trusts the education skill and follows the installation recommendation.
2. The user executes `hermes s ...[truncated 1423 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the broad ecosystem installation recommendation unless all listed components are necessary for the education skill.
2. Allow users to install only the minimum individual components required for a specific feature.
3. Pin every dependency to an audited, immutable version and cryptographic digest rather than a mutable package identifier.
4. Publish the authoritative source repository, complete dependency manifest, transitive dependency list, and expected integrity hashes.
5. Document the permissions and data access required by each component before installation.
6. Require explicit user approval for sensitive capabilities, particularly central orchestration, cross-agent memory, publishing, and monetization access.
7. Verify package signatures and integrity hashes before installation and fail closed when verification is unavailable or unsuccessful.
8. Review each release and its transitive dependencies before updating the pinned version.
9. Run third-party skills with least privilege in an isolated environment, restricting filesystem, network, credential, memory, and inter-agent access by default.
10. Provide a lockfile or equivalent reproducible installation manifest so the reviewed dependency set is the same dependency set users receive.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep