Insight Claw Hermes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:26 AM UTC
• Version: 0.3.1

Overview

The skill is coherent for setting up a stock-analysis tool, but it tells the agent to run mutable remote code and unhashed dependencies, so it should be reviewed before installation.

Install only if you are comfortable letting the agent clone and run the current state of the upstream GitHub project. Prefer pinning a specific reviewed commit, using a hashed lockfile, running in a restricted environment, and providing only the credentials needed for the specific analysis run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unpinned Remote Repository Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64-76
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Complete Code Snippet

bash

git clone https://github.com/GeraltJc/insight-claw.git insight-claw
cd insight-claw
python -m venv .venv
.venv/bin/python -m pip download --no-cache-dir --no-deps --dest /tmp/insight-claw-pip-probe-pypi --index-url https://pypi.org/simple requests==2.32.5
.venv/bin/python -m pip download --no-cache-dir --no-deps --dest /tmp/insight-claw-pip-probe-tuna --index-url https://pypi.tuna.tsinghua.edu.cn/simple requests==2.32.5

The downloaded project is subsequently executed:

bash

.venv/bin/python -m justice_plutus run --stocks 000001,600519 --workers 1 --no-notify

Equivalent instructions also appear in references/quickstart.md:8-13 and references/quickstart.md:53-56.

Technical Analysis

The Skill clones the current state of a remote Git repository without pinning an immutable commit hash or verifying a signed tag. It then instructs the agent to execute a Python module supplied by that repository.

Consequently, the effective executable payload is not fixed to the content reviewed with this Skill. A compromised upstream account, repository, branch, or release process could alter the downloaded code after this bundle passes review. HTTPS protects transport integrity but does not ensure that the fetched repository revision is the one previously audited.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its default branch.
2. The attacker adds malicious behavior to justice_plutus, an imported module, or installation-time project code.
3. A user invokes this Skill for first-time setup.
4. The agent clones the attacker-controlled current repository state.
5. The agent installs the project dependencies and runs python -m justice_plutus.
6. The malicious code executes with the permissions and environment of the invoking ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a previously reviewed immutable commit hash:

   bash

   git clone https://github.com/GeraltJc/insight-claw.git insight-claw
   cd insight-claw
   git checkout --detach EXPECTED_COMMIT_SHA
   

2. Verify that HEAD exactly matches the expected commit before installing or executing anything:

   bash

   test "$(git rev-parse HEAD)" = "EXPECTED_COMMIT_SHA"
   

3. Prefer a signed release tag and verify its signature in addition to pinning the resolved commit.
4. Record the approved repository URL and commit in the Skill rather than relying on the mutable default branch.
5. Review changes before updating the pinned revision; never automatically execute a newly fetched revision.
6. Run the downloaded project in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Dependency Installation Without Cryptographic Hash Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:81-96
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet

bash

.venv/bin/python -m pip download --no-cache-dir --no-deps --dest /tmp/insight-claw-pip-probe-pypi --index-url https://pypi.org/simple requests==2.32.5
.venv/bin/python -m pip download --no-cache-dir --no-deps --dest /tmp/insight-claw-pip-probe-tuna --index-url https://pypi.tuna.tsinghua.edu.cn/simple requests==2.32.5

bash

.venv/bin/python -m pip install -r requirements.txt

bash

.venv/bin/python -m pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple

Equivalent installation instructions appear in references/quickstart.md:15-32.

Technical Analysis

The Skill installs all packages listed in a remotely obtained requirements.txt without requiring cryptographic hashes. The audit evidence does not establish whether every dependency in that file is exactly pinned, and the manifest itself is outside the reviewed bundle.

The alternative mirror is selected based on download speed or availability rather than artifact identity. Although both configured indexes use HTTPS, transport encryption does not provide a reviewed lockfile or guarantee that the installed artifacts match approved package files. A compromised package release, package-maintainer account, index, mirror, or remotely modified requirements file could therefore introduce executable code.

Python packages may run code during installation or later when imported by the analysis command, making this an executable supply-chain boundary.

Attack Path

1. An attacker compromises a required package, its maintainer account, the selected package index or mirror, or the upstream requirements.txt.
2. A malicious package version or artifact becomes eligible for installation.
3. The Skill probes indexes and chooses a successful or faster source.
4. pip install -r requirements.txt downloads pac ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

1. Maintain a reviewed lockfile containing exact versions and SHA-256 hashes for every direct and transitive dependency.
2. Install with hash enforcement:

   bash

   .venv/bin/python -m pip install --require-hashes -r requirements.lock
   

3. Ensure all transitive dependencies are represented in the hashed lockfile.
4. Generate and review separate lockfiles when platform-specific artifacts are required.
5. Require both PyPI and any mirror to serve artifacts matching the same approved hashes; choose mirrors only after artifact identity is enforced.
6. Pin the remote project revision so its dependency manifest cannot change independently of the Skill review.
7. Perform vulnerability and provenance checks before approving lockfile updates.
8. Use a restricted runtime and avoid exposing credentials that are unnecessary during dependency installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

This skill is intended for public Hermes distribution. Keep the bundle small: `SKILL.md` plus optional text references or small helper scripts only when they re

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

Before the first real run, verify that at least one LLM credential is available through Hermes secret handling, the user's shell environment, or a user-approved local .env merge. If .env is missing and the user chooses local persistence, first create it from .env.example:

bash

[ -f .env ] || cp .env.example .env

Then merge only missing keys or keys the user explicitly authorizes replacing. Do not overwrite the whole .env, and never display, transmit, upload, or commit raw secret values.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/quickstart.md (reported line 39)May include surrounding context.

Before the first real run, verify that at least one LLM credential is available through Hermes secret handling, the user's shell environment, or a user-approved local .env merge. If .env is missing and the user chooses local persistence, first create it from .env.example:

bash

[ -f .env ] || cp .env.example .env

Then merge only missing keys or keys the user explicitly authorizes replacing. Do not overwrite the whole .env, and never display, transmit, upload, or commit raw secret values.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file includes core descriptive and operational guidance in Chinese, which effectively imposes a specific language on users without opt-in. The skill does not state that it is region- or language-specific in a way that justifies the constraint, nor does it offer an alternative language choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

.venv/bin/python -m justice_plutus run --stocks 000001,600519 --workers 1 --no-notify

text

Do not automatically run `git pull` in an existing checkout. Reuse the local repository as-is unless the user explicitly asks for an update, or a failed run is traced to version or dependency drift. Before updating, inspect the local worktree state and ask for user approval.

Reinstall dependencies only after approved project updates, `requirements.txt` changes, or virtual environment failure.

Static analysis

No suspicious patterns detected.