Ima Knowledge Base

• Outcome: Review
• Latest audit: Jul 20, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This is a real IMA knowledge-base integration, but it handles live login cookies and authenticated test actions in ways that deserve manual review before installation.

Review before installing. Treat IMA_COOKIE like a password: avoid pasting it into shell history, do not commit ~/.hermes/.env, and prefer scoped OpenAPI credentials where possible. Do not run test_endpoints.py or test_connection.py on an account you care about unless you accept that they may create notes or folders and send authenticated requests. Rotate or delete the cookie if it is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents capabilities to read environment files, write credentials to disk, and make authenticated network requests, but it does not declare any permissions. This creates a transparency and consent problem: users or orchestration systems may invoke a skill that can access local secrets and transmit data externally without an explicit permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose understates several high-risk behaviors: automated browser-based cookie harvesting, persistence of session cookies to ~/.hermes/.env, endpoint probing of private/undocumented APIs, and mention of hardcoded credentials in companion scripts. This mismatch is dangerous because operators may trust the skill as a normal API wrapper while it also performs credential collection and reconnaissance-like actions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script deliberately modifies browser characteristics to evade automation detection by hiding navigator.webdriver and using anti-detection launch flags. For a cookie-capture helper, this behavior is unnecessary and increases security concern because it is designed to bypass site defenses that may exist to protect login and session issuance.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The helper automatically persists a live authentication cookie to ~/.hermes/.env even though its primary stated function is validation. Storing bearer-like session material on disk increases the chance of credential disclosure through weak file permissions, backups, logs, or later unintended reuse, especially because there is no explicit opt-in at the write point.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README explicitly instructs users to extract a live browser authentication cookie and store it in a local env file, but does not clearly warn that this cookie is a bearer credential that may grant broad access to the user's IMA account and knowledge bases. In this skill's context, the cookie-backed /cgi-bin/ path is documented as enabling fuller access than the OpenAPI path, which increases the sensitivity and blast radius of credential mishandling.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs users to copy a full authenticated session cookie and persist it locally, but it does not clearly warn that the cookie is a bearer credential that can grant broad account access if stolen. In this context, the skill supports full knowledge-base operations via Cookie auth, so exposing or mishandling the cookie could compromise private notes, subscribed knowledge bases, and Q&A access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script explicitly instructs users to extract a live browser authentication cookie and then sends that secret to a remote endpoint for validation. Even though the destination is the intended IMA service, authentication cookies are highly sensitive bearer credentials, and the script does not present a clear warning about account takeover risk, safe handling, shell history leakage, or the trust implications of pasting such secrets into a local tool.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script persists the full authenticated cookie string into ~/.hermes/.env, which creates a long-lived local credential artifact that may be readable by other local processes, included in backups, or accidentally committed or shared. Because the cookie appears to grant authenticated access to the IMA account, theft of this file could enable session hijacking and unauthorized knowledge-base access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prints a portion of the authentication cookie/token to the console, exposing sensitive material in terminal history, logs, screenshots, or remote shell transcripts. Even partial token disclosure can aid credential theft, session correlation, or debugging leakage in shared environments.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script contains hardcoded fallback API credentials and then uses them to instantiate a client that performs remote operations. This is dangerous because anyone with access to the code can reuse the exposed secrets, and the script also encourages live network actions against the external service without clear operator warning or safety gating.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes a sensitive session cookie to a local .env file automatically and without a clear consent prompt at the moment of persistence. Authentication cookies are reusable credentials, so silent persistence creates avoidable credential-retention risk on shared machines, synced home directories, or systems with loose access controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically sends authenticated requests using the user's IMA cookie to multiple remote endpoints as soon as it is run, without an explicit confirmation step or strong warning that account-bound credentials will be used. In an agent-skill context, implicit credentialed network activity increases the risk of unintended data access, account actions, or privacy exposure if a user runs the script without fully understanding its behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently reads a sensitive cookie from ~/.hermes/.env and uses it for authentication, which can surprise users and cause credentials to be consumed outside their expectations. In security terms this is unsafe credential handling because it normalizes implicit use of local secrets and expands the blast radius if the script or surrounding workflow is abused.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script explicitly accepts a full browser Cookie string, places it into request headers, and sends it to a remote endpoint using the highly sensitive IMA-TOKEN session material. In this skill context, that behavior is core to how the API is accessed, but it still creates credential-handling risk because users are instructed to extract live browser cookies and paste them into a CLI, where they may be exposed via shell history, logs, process listings, or accidental reuse.

Credential Access

High

• Category: Privilege Escalation

Content

import json

# 读取 Cookie
with open(Path.home() / '.hermes' / '.env') as f:
    content = f.read()
    cookie = re.search(r'IMA_COOKIE=["\'](.+?)["\']', content).group(1)

• Confidence: 93% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path

# 读取 Cookie
env_file = Path.home() / ".hermes" / ".env"
content = env_file.read_text()
cookie = re.search(r'IMA_COOKIE=["\'](.+?)["\']', content).group(1)

• Confidence: 95% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

## Cookie 格式示例
IMA-TOKEN=eyJhbGc...;其他参数=xxx;...

## 验证成功后，Cookie会自动保存到 ~/.hermes/.env
"""

import requests

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""IMA Cookie 验证器"""
    
    BASE_URL = "https://ima.qq.com"
    ENV_FILE = Path.home() / ".hermes" / ".env"
    
    def __init__(self, cookie_str: str = None):
        self.cookie_str = cookie_str or self.load_from_env()

• Confidence: 90% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

return False
    
    def save_to_env(self) -> bool:
        """保存Cookie到.env"""
        if not self.ENV_FILE.exists():
            self.ENV_FILE.parent.mkdir(parents=True, exist_ok=True)
            self.ENV_FILE.write_text('')

• Confidence: 95% confidence
• Finding: .env"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.