ClawHub
Back to skill

Security audit

Hermes Minimax Oauth

Security checks across malware telemetry and agentic risk

Overview

This is a text-only Hermes MiniMax OAuth integration guide, and the credential handling it describes is disclosed and aligned with the login feature.

Before installing, review the resulting Hermes code changes, verify the MiniMax endpoints and client_id, and protect ~/.hermes/auth.json because it may contain reusable OAuth credentials. Use restrictive permissions, avoid shared machines, and make sure you know how to revoke or log out of the MiniMax token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly states that the access_token is stored in `~/.hermes/auth.json` but does not mention file-permission requirements, local compromise risk, or how sensitive OAuth tokens and refresh tokens should be protected. This can lead users to store reusable credentials insecurely on shared systems or in backups, increasing the chance of account takeover if the file is exposed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.