Security audit

Hermes Learning Loop2

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent self-improvement workflow, but it broadly tells the agent to persist session lessons and update memory or skills without clear user approval, redaction, or trust boundaries.

Install only if you want an agent to maintain cross-session learning notes and potentially update its own memory or skills. Review and constrain memory writes first, especially for confidential work, credentials, personal data, proprietary workflows, or any environment where user-supplied corrections should not become trusted future instructions automatically.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:39
Finding: Unvalidated User Content Can Poison Persistent Agent Memory and Skills
Content: View full analysis
Step 1: Record it immediately Write it to the current memory/YYYY-MM-DD.md: [Error description] -> Cause: [Why it was wrong] -> Correction: [What is correct] -> Lesson: [How to avoid it later] -> Step 2: Check whether existing knowledge is affected Search MEMORY.md and related Skills for entries requiring updates. If found, correct them immediately. -> Step 3: Propagate it to related contexts If the error concerns a specific platform, update the corresponding notes. If it is a general methodology, write it to the "Lessons" section of MEMORY.md. ``` ```text Periodic skill review: 1. Read the most recent five days of memory/*.md logs. 2. Identify recurring operation patterns. 3. Check whether existing Skills cover those patterns. 4. For uncovered patterns, evaluate creating a new Skill. 5. For covered patterns with obsolete steps, update the Skill. 6. Mark unnecessary Skills as archived. 7. Update MEMORY.md with ...[truncated 3335 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description and operational instructions are presented entirely in Chinese, with no indication that language choice is optional or that the skill is intended only for Chinese-speaking contexts. This can violate language or locale policy where user opt-in or explicit justification is required.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description advertises automatic retrospection, periodic optimization, and extracting lessons from errors, but does not define scope boundaries or safety conditions. In practice, this encourages ambient activation across many workflows and can lead to unsolicited memory writes or policy-like behavior that users did not explicitly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are intentionally broad and include subjective criteria like 'complex task', 'found a reusable workflow', and 'user corrected my method'. This can cause the skill to activate in many ordinary sessions and then perform persistence behaviors such as logging and knowledge updates without a narrowly scoped user request, increasing the chance of over-collection and unintended side effects.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to write reusable patterns, user corrections, and workflow details into persistent memory files. Because the logging criteria are broad and content-based, the agent may retain sensitive task details, prompts, identifiers, internal procedures, or proprietary information in natural-language notes that can later be retrieved or leaked across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The daily logging guidance says to record all valuable operations, key decisions, and lessons, which semantically encourages broad collection of session content. In a real environment, that can accumulate confidential user requests, operational context, or business logic in persistent files, creating a durable data exposure surface.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The error-handling workflow requires immediate recording of mistakes, causes, corrections, and follow-on propagation into memory and related notes. Error cases often contain the most sensitive material, including failed commands, rejected prompts, user corrections, and fragments of protected data, so automatic persistence materially raises confidentiality and cross-session leakage risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.