Security audit

Hermes Installer

Security checks for vulnerabilities and agentic risk

Overview

This Hermes installer skill is mostly coherent, but it gives broad install/update/container access and includes diagnostics that can send API keys to user-configured endpoints.

Review this skill before installing. It is not clearly malicious, but run it only in an environment where installing mutable code, using Docker, and storing Hermes credentials under ~/.hermes is acceptable. Avoid running doctor.sh against untrusted or mistyped OPENAI_BASE_URL values, do not share raw doctor output without redacting logs, and consider pinning the Hermes repository revision and dependencies before installation or update.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/doctor.sh:98
Finding: API Credential Disclosure Through an Unrestricted Configurable Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:111
Finding: Unpinned Remote Source and Dependencies Are Installed and Executed
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: docker-deploy.md:5
Finding: Docker Container Receives Broad Writable Access to the Entire Hermes Directory
Content: View full analysis
/dev/null || true docker rm hermes-container 2>/dev/null || true docker run -d --name hermes-container -v ~/.hermes:/opt/data hermes-agent ``` ### Technical Analysis The Docker instructions bind-mount the entire `~/.hermes` directory into the container without the read-only flag. This directory includes or may include: - `~/.hermes/.env`, containing API keys and gateway tokens. - `~/.hermes/config.yaml`. - Logs and application state. - `~/.hermes/hermes-agent`, containing the cloned host-side source tree. The container therefore receives both read and write access to credentials, application state, logs, and source code. This is broader than the minimum access needed for configuration persistence. Mounting host-side source inside the container also allows a compromised image or runtime dependency to modify files that may later be executed directly on the host. The instructions do not specify a non-root container user, read-only filesystem, capability restrictions, or separate secret handling. ### Attack Path 1. A malicious or compromised package is incorporated while building the Hermes image, or the running service is remotely compromised. 2. Code executing inside the container reads `/opt/data/.env`. 3. It exfiltrates model-provider keys, Feishu secrets, Telegram tokens, or Discord tokens. 4. Because the mount is writable, it modifies files under `/opt/data/h ...[truncated 758 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/doctor.sh:132
Finding: Diagnostic Script Prints Unredacted Application Error Logs
Content: View full analysis
/dev/null || echo "0") if [ "$ERROR_COUNT" -gt 0 ]; then echo " ⚠️ 发现 $ERROR_COUNT 条错误日志" echo "" echo " 最近错误:" grep -i "error" "$LOG_FILE" | tail -3 | sed 's/^/ /' WARNINGS=$((WARNINGS + 1)) else echo " ✅ 未发现错误日志" ``` ### Technical Analysis The health-check script prints the last three log lines containing the word `error` without redaction. Application errors commonly include request URLs, headers, exception data, user messages, provider responses, identifiers, or accidentally logged credentials. Diagnostic output may be copied into support tickets, retained in terminal history or CI logs, or captured in an AI-agent conversation. Printing raw error lines therefore moves potentially sensitive data from a restricted local log into less controlled output channels. Counting errors is appropriate for a health check, but displaying complete raw records by default is not necessary. ### Attack Path 1. Hermes writes an error containing sensitive content to `~/.hermes/logs/agent.log`. 2. The user runs `bash scripts/doctor.sh`. 3. The script selects matching log lines and prints them without filtering. 4. Terminal capture, CI output, a support transcript, or another observer receives the sensitive data. 5. A recipient can reuse any exposed credential or access disclosed private information. An attacker may also attempt to cause crafted error messages to be logged before persuading the user to share diagnostic output. ### Impact Assessment The exact impact depends on log contents. Potential exposure includes: - API keys or bearer tokens. - Gateway tokens and application secrets. - Internal or cust ...[truncated 260 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to focus on installation, deployment, updates, and configuration, but it also includes stopping the gateway and uninstalling Hermes, including deletion of local program and configuration data. That mismatch is dangerous because a user invoking a setup-oriented skill may not anticipate destructive actions that can disrupt service or erase state.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to focus on installation, deployment, updates, and configuration, but it also includes stopping the gateway and uninstalling Hermes, including deletion of local program and configuration data. That mismatch is dangerous because a user invoking a setup-oriented skill may not anticipate destructive actions that can disrupt service or erase state.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docker-deploy.md (reported line 50)May include surrounding context.
docker rmi hermes-agent

3. 删除配置目录（可选）

rm -rf ~/.hermes

text
---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docker-deploy.md (reported line 50)May include surrounding context.
docker rmi hermes-agent

3. 删除配置目录（可选）

rm -rf ~/.hermes

text
---

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gateway-config.md (reported line 36)May include surrounding context.
5. 配置环境变量

bash
# ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gateway-config.md (reported line 69)May include surrounding context.
5. 配置环境变量

bash
# ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gateway-config.md (reported line 94)May include surrounding context.
5. 配置环境变量

bash
# ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gateway-config.md (reported line 110)May include surrounding context.
5. 配置环境变量

bash
# ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/doctor.sh (reported line 56)May include surrounding context.
sh
### 5. 配置环境变量 ```bash # ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/doctor.sh (reported line 77)May include surrounding context.
sh
### 5. 配置环境变量 ```bash # ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/doctor.sh (reported line 126)May include surrounding context.
sh
### 5. 配置环境变量 ```bash # ~/.hermes/.env FEISHU_APP_ID=cli_xxx FEISHU_APP_SECRET=xxx FEISHU_ENABLED=true

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/doctor.sh (reported line 9)May include surrounding context.
sh
HERMES_DIR="$HOME/.hermes" HERMES_AGENT_DIR="$HERMES_DIR/hermes-agent" ENV_FILE="$HERMES_DIR/.env" CONFIG_FILE="$HERMES_DIR/config.yaml" echo "╔════════════════════════════════════════╗"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/uninstall.sh (reported line 46)May include surrounding context.
sh
HERMES_DIR="$HOME/.hermes" HERMES_AGENT_DIR="$HERMES_DIR/hermes-agent" ENV_FILE="$HERMES_DIR/.env" CONFIG_FILE="$HERMES_DIR/config.yaml" echo "╔════════════════════════════════════════╗"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 40)May include surrounding context.
sh
# 保留配置，只删除程序 echo "🗑️ 删除程序文件..." rm -rf "$HERMES_DIR/hermes-agent" rm -rf "$HERMES_DIR/venv" echo "✅ 卸载完成！配置文件保留在 $HERMES_DIR" else

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 41)May include surrounding context.
sh
# 保留配置，只删除程序 echo "🗑️ 删除程序文件..." rm -rf "$HERMES_DIR/hermes-agent" rm -rf "$HERMES_DIR/venv" echo "✅ 卸载完成！配置文件保留在 $HERMES_DIR" else echo "⚠️ 将完全删除 Hermes Agent 及所有配置"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly instructs shell-capable operations such as git clone, pip install, docker build/run, and execution of local scripts, but it does not declare any tool scope or allowed-tools boundary. In an agent setting, this increases the chance that the skill is invoked with broader-than-expected execution privileges and can perform impactful system changes without explicit least-privilege constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger conditions are broad and include many generic installation, deployment, update, and provider-configuration phrases without clear exclusion boundaries. In an agent ecosystem, broad activation raises the risk of the skill being selected in contexts where users did not intend shell execution, installation changes, gateway control, or destructive maintenance actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata and document content are entirely written in Chinese, indicating a fixed language/locale presentation for the skill. There is no statement that the user may choose another language or that the Chinese-only scope is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The section labeled '方式二：Docker 部署' claims to document Docker deployment, but the commands shown are the same pip/uv virtualenv workflow used for command-line deployment rather than Docker operations. This is an active documentation contradiction that could mislead a user into performing a non-Docker installation while believing they are following Docker instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The Docker example runs a locally built image by tag only, without pinning a version or digest. While less severe than pulling an unpinned remote image directly, this still weakens reproducibility and can cause users to execute a stale, replaced, or unintended image if the local tag is overwritten.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs users to configure third-party model endpoints and supply API keys, but it does not clearly warn that prompts, files, metadata, and credentials-adjacent configuration will be transmitted to external providers. In an installer/configuration skill, this omission can cause users to unknowingly send sensitive business or personal data to outside services with different retention, logging, and jurisdictional policies.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-config.md (reported line 69)May include surrounding context.
yaml
model: provider: custom base_url: https://api.z.ai/api/paas/v4/ default: MODEL_NAME

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-config.md (reported line 76)May include surrounding context.
yaml
model: provider: custom base_url: https://api.z.ai/api/paas/v4/ default: MODEL_NAME

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-config.md (reported line 95)May include surrounding context.
yaml
model: provider: custom base_url: https://api.kimi.com/coding/v1 default: MODEL_NAME

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-config.md (reported line 102)May include surrounding context.
yaml
model: provider: custom base_url: https://api.kimi.com/coding/v1 default: MODEL_NAME

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tool Parameter Abuse

3. 删除配置目录（可选）

rm -rf ~/.hermes

Tool Parameter Abuse

3. 删除配置目录（可选）

rm -rf ~/.hermes

Credential Access

5. 配置环境变量

Credential Access

5. 配置环境变量

Credential Access

5. 配置环境变量

Credential Access

5. 配置环境变量

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Undeclared Tool Scope

Vague Triggers

Natural-Language Policy Violations

Intent-Code Divergence

Rp1

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis