ClawHub
Back to skill

Security audit

hermes-backup-restore

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Hermes backup and restore utility, but it packages secrets, sessions, profiles, and memories into portable archives without enough protection or warning.

Review before installing. Use this only if you intend to create full Hermes backups that may contain API keys, auth tokens, sessions, memories, and profiles. Store archives in an encrypted or access-controlled location, avoid sharing them, run dry-run first, and make a fresh backup before restoring because default restore can overwrite current state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and instructs shell-script execution but does not declare corresponding permissions, which creates a transparency and policy-enforcement gap. In an agent setting, undeclared shell capability can cause users or orchestration layers to invoke filesystem-impacting operations without appropriate consent or sandboxing expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The backup scope explicitly includes secrets, .env files, auth.json, and profiles, but the documentation does not warn that the resulting archive contains sensitive authentication material. This omission increases the chance that users will store, transfer, or share the archive insecurely, leading to credential disclosure and account compromise.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The restore section provides commands that can replace existing Hermes state but does not clearly warn that restore may overwrite config, databases, sessions, memories, or secrets. Users may unintentionally destroy current data or revert to stale credentials, especially when using --force or restoring onto an active installation.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
This backup script intentionally archives highly sensitive material including secrets, authentication data, memories, and sessions into a portable tar.gz archive, but it provides no prominent warning, encryption, or permission hardening. In the context of a backup/migration skill, collecting secrets is expected, but failing to clearly warn and protect the resulting archive materially increases the chance of credential or private-data exposure.

Credential Access

High
Category
Privilege Escalation
Content
# ── Files and directories to INCLUDE (relative to HERMES_HOME) ────────────────
INCLUDE_ITEMS=(
  "config.yaml"
  ".env"
  "auth.json"
  "SOUL.md"
  "skills"
Confidence
93% confidence
Finding
Including .env and auth.json in the backup captures credentials, tokens, and other secrets that can grant direct access to external services or the Hermes environment if the archive is exposed. In a backup utility this behavior is functionally intentional, but it remains security-sensitive because the archive becomes a concentrated bundle of credential material.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if [[ -f "$db_path" ]]; then
    # Only remove WAL/SHM if the backup didn't include them (sqlite3 .backup produces none)
    if [[ ! -f "$STAGE_ROOT/$db_name-wal" ]] && [[ ! -f "$STAGE_ROOT/$db_name-shm" ]]; then
      rm -f "$db_path-wal" "$db_path-shm" 2>/dev/null || true
    fi
  fi
done
Confidence
92% confidence
Finding
The script derives deletion targets from user-controllable HERMES_HOME/TARGET and then runs rm -f on constructed paths without canonical path validation. If the script is run with an unsafe target, especially as a privileged user, it can delete files outside the intended Hermes directory via symlinked or attacker-chosen paths, making this more dangerous in a restore utility that handles arbitrary archives and destinations.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
fi
done
# Also clean lock files that gate SQLite access
rm -f "$HERMES_HOME/state.db.repair.lock" "$HERMES_HOME/state.db.fts_rebuild.lock" 2>/dev/null || true
echo "  ✓ Stale WAL/SHM and repair locks cleaned"

# ── Verify SQLite integrity ──────────────────────────────────────────────────
Confidence
92% confidence
Finding
This unconditional rm -f of lock files uses paths built from HERMES_HOME, which may be set by a caller to arbitrary locations. In a restore script that may be executed by administrators, lack of path restrictions can cause unintended deletion of attacker-selected files under crafted directory structures or symlinked targets.

Static analysis

No suspicious patterns detected.