mumo (Hermes Agent)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:33 AM UTC
• Version: 0.6.3

Overview

This looks like a legitimate mumo integration, but it can send sensitive designs, auth flows, and security material to an external multi-model service without clear redaction or confirmation guardrails.

Install only if you are comfortable sending deliberation prompts to mumo and potentially downstream model providers. Before using it on security, auth, payment, customer, or proprietary material, redact secrets and personal data, send only the minimum necessary excerpts, and avoid using share_session unless you intentionally want a public session link.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: playbooks/design-review.md:7

Finding

Insufficient Data Minimization Before External Multi-Provider Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md

#
#     MUMO_API_KEY=mmo_live_your_key_here
#
# Hermes resolves ${MUMO_API_KEY} in headers at connect time, and .env is where
# it expects secrets to live — config.yaml is for everything that isn't one.
# A hub install (`hermes skills install clawhub/mumo-hermes`) prompts for the
# key and writes that .env line for you.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/mumo.yaml (reported line 8)May include surrounding context.

yaml

#
#     MUMO_API_KEY=mmo_live_your_key_here
#
# Hermes resolves ${MUMO_API_KEY} in headers at connect time, and .env is where
# it expects secrets to live — config.yaml is for everything that isn't one.
# A hub install (`hermes skills install clawhub/mumo-hermes`) prompts for the
# key and writes that .env line for you.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/mumo.yaml (reported line 11)May include surrounding context.

yaml

#
#     MUMO_API_KEY=mmo_live_your_key_here
#
# Hermes resolves ${MUMO_API_KEY} in headers at connect time, and .env is where
# it expects secrets to live — config.yaml is for everything that isn't one.
# A hub install (`hermes skills install clawhub/mumo-hermes`) prompts for the
# key and writes that .env line for you.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CHANGELOG.md (reported line 9)May include surrounding context.

md

README and SKILL.md setup steps updated to match, and the README no longer says a hub install "handles the MCP server registration" — Hermes prompts for the key and saves it; the `mcp_servers` block is still added by hand.

The `.env` step creates and `chmod 600`s the file before the key goes in, and tells you to edit it rather than append from the shell — a command carrying the literal key lands in shell history, and a second run stacks a duplicate entry. A new verification step runs `hermes mcp test mumo` — a real connection that lists the tools — before the first deliberation; `hermes mcp list` only reports saved config and cannot show whether the key resolved.

## 0.6.2 — 2026-09-08

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 34)May include surrounding context.

md

- New "Reactions are in the ledger, responses are on the record" section: participants never see each other's reactions — each model weaves its own prior reactions into its next response, and the claim map is the moderator's privileged preview. Moderator snippets are the one path that puts ledger content directly in front of the panel.
- Pacing note in "When to continue": positions develop across rounds — a reaction gets woven into the next round's prose, which draws reactions of its own a round later.
- Takeaway: `takeaway: true` (create + append) generates `round_takeaway` (`bottom_line` + `items[]`), the per-round summary. New `references/takeaway.md` (replaces `references/recap.md`).

## 0.4.0 — 2026-06-19

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 100)May include surrounding context.

md

Initial release. Hermes Agent skill for mumo's MCP server.

- `skills/mumo/SKILL.md` — kernel teaching the deliberation loop, snippet doctrine, claim-map reading, when-to-invoke triggers, and the verification discipline (real session IDs are UUIDs; verify with `list_sessions` if uncertain).
- `skills/mumo/playbooks/` — four cognitive-shape playbooks: `contested-decision`, `design-review`, `uncertainty-expansion`, `red-team`.
- `skills/mumo/reference/` — five reference docs: `claim-maps`, `snippets`, `model-selection`, `synthesis`, `operating-notes`.
- `config/mumo.yaml` — MCP server entry to merge into `~/.hermes/config.yaml` with `tools.include` allowlist scoping mumo to its seven tools.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

hermes skills install clawhub/mumo-hermes

text

The slug is `mumo-hermes` — the bare `clawhub/mumo` slug is the OpenClaw variant of this skill (different tool-name prefix and setup steps), so install this one. Hermes prompts for your `MUMO_API_KEY` at install time and saves it to `~/.hermes/.env`; you add the MCP server block yourself (below). Sign up at [mumo.chat](https://mumo.chat) and create a platform key at [Settings → API Keys](https://mumo.chat/settings/api-keys) (keys start with `mmo_live_`) before installing.

### Local install via git clone

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Then add the MCP server config: open ~/.hermes/config.yaml and merge the contents of config/mumo.yaml under your mcp_servers: key. The block references ${MUMO_API_KEY} rather than embedding the key, so put the key in ~/.hermes/.env instead.

Create the file and restrict it before putting anything in it, so the key is never written into a world-readable file:

bash

touch ~/.hermes/.env && chmod 600 ~/.hermes/.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

Create the file and restrict it before putting anything in it, so the key is never written into a world-readable file:

bash

touch ~/.hermes/.env && chmod 600 ~/.hermes/.env

Then open ~/.hermes/.env in your editor and add a line:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

required_environment_variables:
  - name: MUMO_API_KEY
    prompt: "mumo platform API key (mmo_live_*)"
    help: "Create one at https://mumo.chat/settings/api-keys"
    required_for: mumo MCP server authentication
metadata:
  hermes:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to use' section includes expansive triggers such as 'strategy questions with multiple defensible framings' and especially 'explicit user requests' without defining concrete invocation phrases or exclusion examples. In a markdown skill description, this makes activation scope ambiguous and increases the chance the skill is invoked for general discussion rather than clearly bounded high-stakes deliberation cases.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

## User preferences

These are defaults. If the user prefers more autonomy (e.g., "don't ask before appending" or "always include a GPT and a Gemini model"), follow their preferences over this guidance.

## Basic loop

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:52