ClawHub
Back to skill

Security audit

Hermes Deployer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Hermes deployment guide, but its default settings could expose a persistent server agent and bot/API credentials to unintended chat users.

Install only if you intentionally want a long-running Hermes bot on a Linux server. Before using it in production, pin the Hermes source version, restrict allowed users/channels, avoid `bypassPermissions` and `GATEWAY_ALLOW_ALL_USERS=true` unless you fully accept the risk, protect `~/.hermes/.env` with restrictive permissions, and consider disabling memory and auto-improvement until monitoring and rollback are in place.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly says the AI will automatically load the skill and execute standard deployment and operations flows on Linux servers, but it does not warn that these actions may install software, modify configuration, manage services, or affect running systems. In a server-deployment skill, that omission increases the risk of users triggering impactful administrative actions without clear consent boundaries or safety expectations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs users to create a plaintext ~/.hermes/.env file containing API keys and bot tokens, but provides no warnings about file permissions, secret exposure, backups, shell history, or log leakage. In a server deployment context, mishandled credentials can lead to unauthorized access to LLM accounts and messaging bots.

Missing User Warnings

High
Confidence
98% confidence
Finding
The configuration recommends permissions.mode: bypassPermissions and also shows open DM/group policies and allow-all access patterns elsewhere, which materially lowers security boundaries for an autonomous agent. In a 24/7 network-connected bot deployment, this can let untrusted users induce actions or access capabilities without meaningful authorization checks.

Static analysis

No suspicious patterns detected.