T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:84- Finding
Automatic Persistent Collection and Retrieval of Conversational Information
- Content
View full analysis
- Remediation
View remediation
Security audit
Elite Human Memory Hermes
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not malicious, but it should be reviewed carefully because it can automatically store, index, and retrieve conversation history without tight consent or deletion boundaries.
Install only if you want a Hermes agent to keep durable local memory. Before enabling it, set explicit rules for what may be remembered, require confirmation for inferred memories, avoid storing secrets or regulated personal data, and define how to inspect and delete entries from daily files, MEMORY.md, conflict logs, Hermes memory, and vector indexes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes persistent storage of daily memory files, curated long-term memory, conflict logs, and vector embeddings, but does not clearly warn users that potentially sensitive conversational data may be retained and indexed for later semantic search. This creates a substantial privacy and data-handling risk because users may disclose secrets, personal data, or confidential project information without informed consent about persistence and retrieval scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guide states that the skill will create the memory structure 'as needed' and elsewhere recommends automatic writing, but it does not pair that behavior with a clear user-facing warning or confirmation model. This can lead to silent data creation and modification on disk, which is risky for privacy, auditability, and user trust, especially in agents integrated with persistent storage and vector indexing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions for automatic memory access are subjective and broad, such as acting when context 'feels incomplete or contradictory' or when preferences appear repeated. In a memory skill with file read/write access, this can cause the agent to read or persist user data without clear consent boundaries, increasing privacy risk and making behavior unpredictable across conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states the agent will 'automatically begin using semantic search + metadata filtering' when users reference past context, which is an overly broad activation trigger. In a memory skill, this can cause unintended invocation on ambiguous prompts, increasing the chance of unnecessary retention, retrieval of sensitive prior context, or unexpected tool use without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auto-read trigger includes the vague condition that memory should be read when 'the current context feels incomplete or contradictory,' which gives the agent broad discretion to access persisted memory without a clear user request. In a memory skill that stores conversational data and semantic indexes, this can cause unnecessary retrieval of sensitive historical information and increase privacy exposure beyond user expectations.
- Content