Hermes Work Visualization

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.1.4

Overview

This skill is not clearly malicious, but it needs review because it presents hard-coded sample data as current work analytics and its monitor stop command can terminate unrelated matching processes.

Review this skill before installing if you need accurate analytics or safe monitoring. Its reports should be treated as demo/sample output unless rewritten to use real Hermes telemetry, and the monitor stop command should be fixed to track and stop only its own PID. Also review generated report and log files before sharing them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:200

Finding

Broad Process Matching Can Terminate Unrelated Processes

Content

View full analysis

Remediation

View remediation

/cmdline` or an equivalent platform API. - Confirm that the command references the exact resolved path of the expected `monitor.py`. - Confirm that the process belongs to the expected user. 6. Send `SIGTERM` with `os.kill(pid, signal.SIGTERM)` only after validation. 7. Wait for graceful shutdown and use a bounded timeout before considering stronger termination. 8. Remove stale PID files safely after shutdown. 9. If multiple monitor instances are intentionally supported, maintain a validated registry rather than using a broad regular expression. The status command should use the same validated PID-file mechanism instead of `pgrep -f`. ]]>

other

Warning

• Location: scripts/session_summary.py:119

Finding

Hard-Coded Sample Metrics Are Presented as Current Hermes Analytics

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared scanning of ~/.hermes/skills and reading metadata files expands the skill's access to local filesystem contents beyond what the description suggests. In this context, a visualization skill that inventories other skills and reads their files can expose sensitive metadata or create privacy surprises if not disclosed and permission-scoped.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documentation instructs use of Python scripts, environment-variable handling, config files, and report generation, but it does not declare any tool scope or permissions. That creates a trust and review gap: users and platforms cannot easily assess that the skill needs shell, filesystem, and environment access before running it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises tracking of tasks, code changes, tool usage, and session statistics, which can include sensitive project activity and behavioral data. Without a privacy warning, users may enable or run it without understanding that reports could reveal confidential codebase structure, workflows, or operational details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Report-generation and export features can persist sensitive session or project information to disk in HTML/Markdown or other shareable formats. Without warnings about data sensitivity, storage location, and sharing risk, users may unintentionally create artifacts that leak internal details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This JSON manifest text describes behaviors that can affect user data, including visualizing code editing history and automatically generating summaries, and later indicates reports are exported and saved. For markdown/manifest-style descriptions, users should be warned when outputs may persist potentially sensitive work data or code-related information, but no such warning appears here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes visualization of task progress, skill usage, code changes, and session statistics for Hermes Agent work. However, all three report generators assemble fixed sample metrics and task/tool/code-change entries instead of reading any actual Hermes session data, so the produced reports do not reflect real work state.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export_report.py (reported line 623)May include surrounding context.

python

import subprocess
        for file in files:
            try:
                subprocess.run(['xdg-open', str(file)], check=False)
            except:
                pass

Tainted flow: 'file' from os.environ.get (line 615, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/export_report.py (reported line 623)May include surrounding context.

python

import subprocess
        for file in files:
            try:
                subprocess.run(['xdg-open', str(file)], check=False)
            except:
                pass

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring says it generates a detailed work report, and the manifest describes visualization of task progress, skill usage, code changes, and session statistics. However, the report sections are populated with fixed literal datasets and percentages in functions like the activity timeline, skill heatmap, hourly distribution, efficiency metrics, and trend analysis, so the output does not reflect real Hermes activity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code returns 'zh' as the default fallback language when no explicit user language or supported system locale is detected. That imposes a specific locale choice on users without offering selection or documenting a region-specific justification, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The monitor writes persistent log entries to a file under the user's home directory without strong upfront disclosure at the point of initialization, and logging begins as soon as the monitor runs. While the current logged content is limited, undisclosed persistent telemetry can expose user activity patterns and create privacy risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A work-visualization monitor is expected to observe state, but this implementation includes process-termination logic that can affect the host system. That mismatch increases risk because users may grant trust to a passive monitoring tool that actually has destructive control functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The stop action can terminate processes immediately via external utilities without prior confirmation, dry-run output, or exact target validation. In context, that makes a supposedly passive visualization tool capable of causing unintended service disruption on the user's machine.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor.py (reported line 202)May include surrounding context.

python

# 查找并终止监控进程
    import subprocess
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'work-visualization.*monitor.py'],
            capture_output=True,
            text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor.py (reported line 227)May include surrounding context.

python

# 查找并终止监控进程
    import subprocess
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'work-visualization.*monitor.py'],
            capture_output=True,
            text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 84% confidence

Finding

The code kills every PID returned by a broad pgrep -f pattern without verifying executable path, ownership, command line exactness, or obtaining user confirmation. This can terminate unintended processes whose command lines happen to match, creating a local denial-of-service condition and making the 'visualization' skill capable of actively affecting the host.

Content

Scanner excerpt · scripts/monitor.py (reported line 210)May include surrounding context.

python

if result.stdout.strip():
            pids = result.stdout.strip().split('\n')
            for pid in pids:
                subprocess.run(['kill', pid])
            print(f"{stopped} {len(pids)} {processes}")
        else:
            print(no_running)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring explicitly states that it generates the current session's work summary visualization. In practice, functions such as generate_task_progress, generate_skill_usage, generate_tool_calls, generate_code_changes, and generate_session_summary print fixed sample values, which contradicts the documented claim of summarizing the current session.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest and module docstring describe visualization of the agent's real work process, including task progress, skill usage, code changes, and session statistics. However, the generator functions use fixed in-memory lists and canned summary text rather than reading current session data, so the implemented behavior does not match the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code hard-codes support to only 'zh' and 'en' and defaults to English for all other locale settings. That can violate language/locale policy expectations because users with other system locales are silently forced into English without being offered a choice or explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The fallback i18n helper selects the output language from HERMES_LANG or LANG automatically, which can force a locale-dependent experience without the user explicitly choosing it. While a --lang override exists later, the default behavior still applies a language choice implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.