hermes agent skill

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.3

Overview

The skill is mostly coherent, but enabling its advertised persistence can save raw task inputs, outputs, step results, and reusable examples locally without broad redaction or retention controls.

Install only if you are comfortable with an opt-in local memory/evolution system. Keep persistence disabled for sensitive work, or use it only with non-secret task inputs and outputs until the skill adds redaction for execution records, retention/deletion controls, and clearer separation between safe examples and raw user data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises environment-variable based configuration and local persistence controls, but no explicit permissions are declared. That creates a transparency and consent problem: users may install a seemingly simple orchestration skill without realizing it can read configuration from the environment and alter behavior accordingly. In this context, the risk is elevated because the skill also handles conversation-derived insights and persistence settings, so undeclared env access can affect privacy-sensitive data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose understates the actual behaviors: beyond scheduling and memory insight, the skill persists conversation-derived data to local SQLite databases, integrates with session messaging/logging, and runs sensitivity filtering on user content. This mismatch is dangerous because users may consent to orchestration features without understanding that their conversations, inferred preferences, and execution records can be stored or propagated through session systems. The skill context makes this more dangerous because the core feature set explicitly processes user conversations and builds long-term memory, which is privacy-sensitive by nature.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The file states that fallback logging defaults to recording only the topic and not payload contents, but the demo path defines a mock handler that prints full payloads to stdout. Even if this occurs in demonstration code, operators often run examples in real environments, which can expose task results, system events, or other sensitive data to console logs and log collectors. The mismatch between the privacy claim and actual observable behavior increases the risk of accidental data disclosure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code persists full execution records to SQLite, including input parameters, step results, outputs, and errors, which may contain secrets, personal data, or proprietary content. Although persistence is gated by configuration, once enabled there is no minimization, redaction, encryption, or explicit warning at the recording path, increasing the chance of sensitive data being retained on disk unintentionally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Auto-generated skill cards store example_input derived from prior successful executions, which can propagate sensitive user data into a second persistent artifact. This broadens the privacy risk because data from one task may later be surfaced as a reusable template or exposed through listing and retrieval APIs.

VirusTotal

65/65 vendors flagged this skill as clean.