Security audit

hermes-attestation-guardian

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Hermes security-monitoring skill, but it needs review because it can install recurring user crontab jobs and can make an unsigned advisory-feed bypass persist.

Install only from a pinned or signed release path, review the generated cron block before using `--apply`, avoid scheduling `--allow-unsigned`, and verify `$HERMES_HOME`, watch paths, feed URLs, and skill-directory permissions before enabling recurring jobs.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: lib/cron.mjs:115
Finding: Optional Scheduler Installation Creates Cross-Session Persistence
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned npx Installer Introduces Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation
...`. - Pin and publish the expected registry integrity digest for the installer package. - Avoid `-y` where practical so unexpected package installation remains visible to the operator. - Provide a lockfile-backed installation method or a verified standalone installer. - Integrate signed release-manifest verification into the primary installation path rather than presenting it only as a separate standalone procedure. - Pin the source repository to an immutable commit or signed release tag. - Document the expected package registry and advise operators to reject registry or package-name substitutions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup_advisory_check_cron.mjs:48
Finding: Unsigned Advisory Feed Bypass Can Be Installed as a Persistent Scheduled Policy
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: lib/attestation.mjs:7
Finding: Generated Attestations Record an Incorrect Skill Version
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8" curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json" curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig" curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem" curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
node scripts/generate_attestation.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
node scripts/generate_attestation.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
node scripts/generate_attestation.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
node scripts/refresh_advisory_feed.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
node scripts/refresh_advisory_feed.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
node scripts/refresh_advisory_feed.mjs

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code goes beyond passive attestation or drift detection by actively rewriting the user's crontab via writeCrontab(). That creates a privileged state-changing capability in a skill whose stated purpose suggests observation and verification, increasing the risk of persistence, unintended task execution, or operator surprise if the skill is invoked in automation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · test/guarded_skill_verify.test.mjs (reported line 18)May include surrounding context.
js
return spawnSync(process.execPath, [setupScript, ...args], { cwd: skillRoot, encoding: "utf8", env: { ...process.env, ...env }, }); }

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · test/setup_advisory_check_cron.test.mjs (reported line 17)May include surrounding context.
js
return spawnSync(process.execPath, [setupScript, ...args], { cwd: skillRoot, encoding: "utf8", env: { ...process.env, ...env }, }); }

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · test/setup_attestation_cron.test.mjs (reported line 17)May include surrounding context.
js
return spawnSync(process.execPath, [setupScript, ...args], { cwd: skillRoot, encoding: "utf8", env: { ...process.env, ...env }, }); }

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The installation command uses npx skills without pinning a specific package version, which can cause operators to execute an unexpected or newly published package version at install time. In a security-sensitive skill focused on attestation and advisory verification, this weakens supply-chain trust because the bootstrap path itself is not reproducible or tightly controlled.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill exposes shell, network, file-read, and environment-dependent behavior but does not declare any explicit tool scope or permissions boundary. That increases the chance an agent or runtime grants broader capabilities than intended, making dangerous operations like remote fetches, local file access, and scheduled command setup easier to invoke implicitly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: Using npx skills without pinning an exact package version allows the installer to resolve whatever version is current at execution time. If the upstream package is compromised or a breaking/malicious release is published, operators may execute unreviewed code during installation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill invokes an external scheduler binary and uses it to read and write crontab state, which materially expands its authority surface. Even though spawnSync is used without a shell and arguments are fixed, the ability to alter scheduled execution can be abused if scheduleBin or the command content is attacker-controlled elsewhere, and it is not clearly necessary for attestation itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: orchestrateManagedCronRun() writes the merged crontab immediately unless printOnly is set, with no confirmation prompt or safety interlock in this code path. In operator tooling, silent scheduler modification can create persistence, break existing jobs, or cause unexpected recurring execution if called by higher-level automation or with mistaken parameters.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README repeatedly states the skill is "Hermes-only," which is a natural-language restriction to a specific agent context without any opt-in or alternative. Under the policy rule for language/locale-style organizational constraints, this is a documented forced constraint stated in natural language.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/cron.mjs:116

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/attestation_cli.test.mjs:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/guarded_skill_verify.test.mjs:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/setup_advisory_check_cron.test.mjs:14

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/setup_attestation_cron.test.mjs:14