ClawHub
Back to skill

Security audit

Hermes Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill implements a disclosed local memory loop for OpenClaw, with persistent local notes and optional workspace seed blocks, and I found no hidden network, credential, destructive, or obfuscated behavior.

Install this only if you want OpenClaw to keep local cross-session operational memory. Expect a ~/hermes-agent directory with memory, reflection, promotion, and workspace-state files, and optional additive changes to AGENTS.md, SOUL.md, or HEARTBEAT.md. Do not let it store secrets or sensitive personal records, and periodically review or clear the memory files if you no longer want past lessons influencing future work.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill's activation criteria are very broad ('more persistent, more self-correcting, and more proactive across sessions'), which can cause the agent to invoke this skill in many loosely related situations. Because the skill instructs the agent to read and write local memory files and modify workspace guidance files, over-broad triggering expands the circumstances where persistent state is accessed or altered, increasing the chance of unnecessary data retention or unintended behavioral drift.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The listed triggers such as "non-trivial task," "repeated workflow," and "failure or correction" are common, subjective situations without clear boundaries or exclusion conditions. Because the file does not define when the loop should not activate, these phrases could overlap with many ordinary interactions and lead to over-application of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to persistently write to reflections.md, memory.md, and promotions.md without any requirement for user consent, visibility, or change review. Persistent local state can silently accumulate sensitive project details, alter future agent behavior, and create hard-to-audit side effects across sessions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · loop.md (reported line 51)May include surrounding context.

md
- one-off project hacks
- temporary incidents
- subjective style guesses without confirmation
- rules that only matter in one file or one hour

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs creation of persistent files and directories under the user's home directory (~/hermes-agent) without any clear user-facing consent, warning, or discussion of side effects. Even though the content appears operational rather than overtly malicious, silently seeding local state can surprise users, create privacy or persistence concerns, and normalize unauthorized filesystem modification by the agent.

Content

No source excerpt is available for this finding.