hermes-traffic-guardian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 0.0.1-beta5

Overview

This is a disclosed specification-only traffic-monitoring skill with no shipped runtime proxy code, though users should prefer the signed verification path over the unpinned npx install command.

Install only from a trusted source, and prefer the documented signed-release verification workflow or a pinned CLI/source version. If a future implementation is added, review that it preserves opt-in operation, per-process proxy scope, no automatic system CA changes, redacted logs, and no default blocking.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Remote Skill Installation Executes Mutable Third-Party Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-23
Additional Location: README.md:7-12
Vulnerability Type: Unpinned remote installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

markdown

## Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

```bash
npx skills add prompt-security/clawsec --skill hermes-traffic-guardian -a hermes-agent -y

text

The same installation command appears in `README.md:7-12`.

### Technical Analysis

The documented installation command invokes `npx skills` without pinning the CLI to a reviewed version. It also identifies the remote source as `prompt-security/clawsec` without specifying an immutable commit, release tag, or artifact digest. The `-y` flag suppresses interactive confirmation.

Consequently, the code executed and installed when a user follows these instructions may differ from the audited package. The effective payload depends on mutable npm and repository state at installation time.

`SKILL.md:26-103` separately documents a stronger standalone verification procedure that pins the release public-key fingerprint and verifies the signed manifest, archive hash, `SKILL.md`, and `skill.json`. However, the primary `npx` installation command does not integrate or require that verification procedure.

### Attack Path

1. An attacker compromises the npm package used by `npx`, one of its dependencies, the upstream repository, or the relevant publishing credentials.
2. The attacker publishes or exposes a malicious version under the mutable package or repository reference.
3. An operator follows the documented installation command.
4. `npx` retrieves and executes the currently resolved CLI package, and the CLI retrieves the currently resolved Skill content.
5. The `-y` option allows installation to proceed without an interactive review checkpoint.
6. Attacker-controlled code or instructions are installed or executed with the privileges of the operato
...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version, for example by using an exact npm version rather than an unversioned npx skills invocation.
2. Pin the Skill source to an immutable release tag or, preferably, a full commit hash.
3. Require the installed archive and metadata to match the signed release manifest documented in SKILL.md:26-103.
4. Make verified standalone installation the preferred path unless the CLI can enforce equivalent signature and checksum verification.
5. Remove -y where practical so operators retain an opportunity to inspect the resolved source, version, and requested changes.
6. In CI, use a lockfile or an internally mirrored, integrity-checked package and run installation with a minimally privileged account.
7. Document the exact expected CLI version, repository revision, release-key fingerprint, and artifact digest for every release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills ... without pinning a specific version of the skills package, which can cause execution of whatever package version is current at install time. In a security-sensitive skill focused on runtime traffic monitoring, this increases supply-chain risk because a compromised or breaking upstream release could be executed during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.