Security audit

Hermes For Win

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to install Hermes on Windows, but it relies on unaudited scripts, automatic updates, and persistent high-privilege startup behavior.

Install only if you trust the publisher and can inspect the missing PowerShell scripts from an official source. Before running it, verify what GitHub repositories and release artifacts it downloads, avoid highest-privilege auto-start unless necessary, and be prepared to remove the scheduled task and WSL files during uninstall.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: references/README.md:50
Finding: Privileged Cross-Session Persistence Through Windows Task Scheduler and WSL Root
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/README.md:85
Finding: Unverified Remote Payload Download and Automatic Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises one-click installation, background persistence, auto-start, and auto-update behavior without clearly warning users that it will modify startup behavior and keep services running in the background. In a Windows/WSL deployment context, undocumented persistence increases the risk of users authorizing lasting system changes they did not fully understand, which is a meaningful security and consent issue even though the markdown itself is not executing code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill documentation is written in Chinese and does not indicate that the language is optional, selectable, or justified by a region-specific requirement. This can constitute a locale/language policy issue when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.