Skill Autogenesis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.3.2

Overview

This skill is purpose-aligned but belongs in Review because it can automatically change agent skills, memory, prompts, or runtime behavior and can consult past-session history without tight scoping.

Install only if you intentionally want agent-managed procedural memory. Configure the host to ask before any skill-file, memory, prompt, or runtime-config write, and limit session-history searches to an approved project or time range. Do not use this in environments where untrusted repository text, web content, or tool output could be silently promoted into future agent instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:142

Finding

Unscoped Cross-Session History and Persistent Memory Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:142-150
Vulnerability Type: Cross-session information access beyond minimum necessary scope
Risk Level: Medium

Vulnerable Instruction Snippet:

text

Preferred sources, in order:
1. current session context
2. `session_search` results for similar tasks, intents, file types, services, or error patterns
3. memory entries about user habits, project conventions, or repeated workflows
4. direct user phrasing such as "we do this often", "make this reusable", or "use this in other agents"

Treat recurrence as confirmed when any of these rules match:
- the same or equivalent workflow appears 3 or more times across current and past sessions
- the user explicitly requests automatic reuse
- the workflow is long, stable, and clearly generic enough for future reuse

Technical Analysis

The Skill directs the agent to search past sessions and persistent memory when evaluating workflow recurrence. This access can be legitimate for procedural-memory functionality, but the instructions do not require explicit user consent, constrain searches to the active project, limit the returned fields, or prevent unrelated historical information from entering the current context.

Cross-session history may contain private conversations, project identifiers, operational details, or other sensitive information unrelated to the current task. Searching that information by broad concepts such as services, file types, and error patterns exceeds the minimum privilege required to summarize the workflow completed in the current session.

The package does prohibit storing secrets in generated Skills, which partially limits downstream exposure. It does not, however, establish equivalent access-control and data-minimization requirements for the initial session or memory search.

Attack Path

1. A user loads the Skill to summarize or codify a completed workflow.
2. The Skill instruc ...[truncated 1374 chars]

Remediation

View remediation

Remediation Suggestions

1. Default recurrence analysis to the current session.
2. Require explicit user opt-in before invoking cross-session search or reading persistent memory.
3. Scope searches to a user-approved project, repository, workflow identifier, or time range.
4. Request only metadata or minimal excerpts needed to establish recurrence.
5. Prohibit copying raw historical conversations into generated Skills, prompts, or memory records.
6. Apply redaction for credentials, personal information, hostnames, internal URLs, and temporary identifiers.
7. Display a concise summary of the intended search scope before accessing historical data.
8. Treat unavailable consent or ambiguous scope as recurrence=possible rather than performing a broad search.
9. Document which historical sources influenced a persistence decision without storing their sensitive contents.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:178

Finding

Persistent Memory and Agent-Governance Modification Without Explicit Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:178-181
Vulnerability Type: Unapproved promotion of task-derived content into persistent agent state
Risk Level: Medium

Vulnerable Instruction Snippet:

text

Route non-skill outcomes to the right storage layer:
- user preference or communication style -> user memory
- durable environment fact or project convention -> memory
- agent governance or default behavior -> prompt or runtime config
- unfinished hypothesis or weak pattern -> no persistence yet

Related automatic-persistence instructions also appear at SKILL.md:75-77:

text

5. If the result is an executable procedure and it is frequent and stable, create or patch a skill.
6. If the result is reusable but not frequent enough, store a compact memory note if memory exists.
7. If the result is a preference, boundary, or policy note, update memory or prompts instead of creating a skill.

Technical Analysis

The Skill explicitly routes task-derived preferences, project facts, policies, and governance guidance into persistent memory, prompts, or runtime configuration. It does not require explicit approval before these writes, even though prompt and runtime changes can alter future agent behavior more broadly than creating a narrowly scoped procedural Skill.

The instructions do not define a trust boundary between:

• Direct user instructions.
• Repository documentation.
• Web content.
• Tool output.
• Text supplied by an attacker or other untrusted party.

Consequently, attacker-controlled content encountered during an otherwise legitimate task could be misclassified as a user preference, durable project convention, or governance rule and then promoted into long-term state. Once persisted, that content may influence later sessions even when the original untrusted source is no longer present.

The Skill requires explicit approval for destructive Skill deletion, but no equivalen ...[truncated 1812 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before every prompt, runtime-configuration, governance, or sensitive memory modification.
2. Present the exact proposed content, destination, scope, provenance, and expected lifetime before writing it.
3. Persist preferences and policies only when they originate from a direct, authenticated user instruction—not from repository files, web pages, tool output, or quoted text.
4. Add a provenance field identifying the session, user request, and trusted source behind every persistent entry.
5. Treat all task content as untrusted by default for persistence purposes.
6. Separate descriptive project facts from behavioral instructions; project facts must not silently become governance rules.
7. Add expiration, review, rollback, and deletion mechanisms for all generated memory and prompt changes.
8. Restrict prompt or runtime updates to an allowlisted configuration area rather than permitting semantic mapping to arbitrary host capabilities.
9. Require stronger approval for global or cross-project changes than for project-scoped memory.
10. Add an explicit hard stop: content originating from external or repository-controlled sources must never be persisted as an agent instruction without user verification.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

- if a supporting file is large or structured, keep it outside `SKILL.md` and manage it through supporting-file actions

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

- if a supporting file is large or structured, keep it outside `SKILL.md` and manage it through supporting-file actions

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/fallback/creating-skills.md (reported line 29)May include surrounding context.

md

- key: my.setting
        description: "What this setting controls"
        default: "sensible-default"
        prompt: "Display prompt for setup"
required_environment_variables:          # Optional — env vars the skill needs
  - name: MY_API_KEY
    prompt: "Enter your API key"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/fallback/work-with-skills.md (reported line 22)May include surrounding context.

md

279: 
280: **Use categories.** Organize skills into subdirectories (`~/.hermes/skills/devops/`, `~/.hermes/skills/research/`, etc.). This keeps the list manageable and helps the agent find relevant skills faster.
281: 
282: **Update skills when they go stale.** If you use a skill and hit issues not covered by it, tell Hermes to update the skill with what you learned. Skills that aren't maintained become liabilities.
283: 
284: ---
285:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file includes a full Chinese section as a required parallel presentation, but it does not say that language selection is optional or limited to a specific region or audience. Under the policy rule, forcing or assuming a locale/language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance is broad enough to encourage loading this skill early and applying it to 'every substantial task,' which can cause the agent to invoke persistence-oriented behavior in many contexts where it is unnecessary. In practice, this increases the chance of unintended skill creation, excessive memory writes, or procedural codification of transient work, especially in autonomous agent environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/fallback/skill-manager-tool.md (reported line 10)May include surrounding context.

md

12: broad and declarative. Skills are narrow and actionable.
13: 
14: Actions:
15:   create     -- Create a new skill (SKILL.md + directory structure)
16:   edit       -- Replace the SKILL.md content of a user skill (full rewrite)
17:   patch      -- Targeted find-and-replace within SKILL.md or any supporting file
18:   delete     -- Remove a user skill entirely

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This documentation explicitly describes that an agent can create, update, and delete its own skills, including full-file replacement and file removal, but it does not include any safety guidance, authorization boundaries, or warnings about modifying agent-managed files. In a skill/autogenesis context, that omission is meaningful because it normalizes persistent self-modification and deletion capabilities that could be abused by prompt injection, faulty automation, or confused agents to corrupt procedural memory or remove safeguards.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/fallback/work-with-skills.md (reported line 18)May include surrounding context.

md

275: 
276: **Keep skills focused.** A skill that tries to cover "all of DevOps" will be too long and too vague. A skill that covers "deploy a Python app to Fly.io" is specific enough to be genuinely useful.
277: 
278: **Let the agent create skills.** After a complex multi-step task, Hermes will often offer to save the approach as a skill. Say yes — these agent-authored skills capture the exact workflow including pitfalls that were discovered along the way.
279: 
280: **Use categories.** Organize skills into subdirectories (`~/.hermes/skills/devops/`, `~/.hermes/skills/research/`, etc.). This keeps the list manageable and helps the agent find relevant skills faster.
281:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/hard-stop-rules.md (reported line 9)May include surrounding context.

md

2. If the outcome is a policy, do not create a skill unless it also includes a complete executable procedure.
3. If the outcome is a one-off result, do not create a skill.
4. If the classification record ends with `recommended_action=memory`, `prompt`, or `none`, do not write skill files.
5. If there is no trigger, no ordered action sequence, or no verification signal, do not create a skill.
6. When uncertain, prefer no-op, memory, or prompt over skill creation.

## Fast test

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template's 'When to Use' section contains generic placeholder trigger conditions, which can lead downstream authors or agents to leave activation criteria vague. In an agent skill system, ambiguous invocation rules increase the chance a skill is applied in inappropriate contexts, causing over-broad automation, incorrect actions, or unsafe execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing descriptions. The text says the skill can "create, edit, and manage skill documents" but provides no warning that it may modify skill files or instructions, which could affect user data or system behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.