Security audit

hermes-attestation-guardian

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Hermes security attestation skill with opt-in scheduling and local advisory feed verification, not evidence of hidden or malicious behavior.

Install only if you manage a Hermes environment and want local attestation/advisory checks. Review policy files before use, keep watch and trust-anchor paths limited to intended Hermes/security files, avoid long-term unsigned advisory bypass, and inspect the printed cron block before running any --apply command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The attestation builder accepts policy and extra file lists, normalizes them, and hashes any resolved path without enforcing that those paths remain inside Hermes-managed directories. An attacker who can influence policy or invocation parameters could use the skill as a filesystem oracle to confirm existence and derive stable hashes for arbitrary local files, exposing sensitive system state outside the intended Hermes scope.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This code actively reads and overwrites the user's crontab, which is a persistence and execution-modification capability rather than pure attestation or drift detection. In an operator-managed infrastructure skill, silently installing or replacing scheduled tasks can materially change system behavior and create a strong foothold for persistence if misused or if upstream inputs are compromised.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The subprocess calls invoke an external scheduling binary to list and install crontab contents, expanding the skill's authority beyond observation into system configuration changes. Even without shell injection in this file, subprocess-driven scheduler manipulation increases attack surface and can be abused for persistence or operational disruption when combined with untrusted configuration or a malicious scheduleBin path.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/cron.mjs:116

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/attestation_cli.test.mjs:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/guarded_skill_verify.test.mjs:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/setup_advisory_check_cron.test.mjs:14

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/setup_attestation_cron.test.mjs:14