Hermes Agent Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Hermes CLI bridge, but its documented command pattern can turn delegated prompt text into local shell execution.

Review before installing. Only use this skill when you intentionally want prompts sent to your local Hermes Agent, and avoid sending secrets unless you trust Hermes and its configuration. The skill should be updated to invoke Hermes with separated arguments or another non-shell interface before handling arbitrary prompt text.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:9

Finding

Shell Command Injection Through Unsafe Prompt Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–13
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

markdown

## Usage
Run the following bash command using the `exec` tool, passing the prompt as a string. Note that we rely on `hermes` being in the PATH (e.g., `~/.local/bin/hermes`).

```bash
~/.local/bin/hermes chat -q "your prompt here"

text

The unsafe command-construction pattern is also demonstrated at lines 17–20:

```markdown
1. Call the `exec` tool:
   - `command`: `~/.local/bin/hermes chat -q "Write a quick Python script to monitor system load"`

2. Read the stdout of the `exec` result, which contains Hermes's answer, and relay it back to the user.

Technical Analysis

The skill instructs the agent to construct a shell command by inserting prompt text into a double-quoted command string. If an agent follows this pattern with user-controlled prompt content, shell quoting does not provide adequate isolation.

Within a double-quoted shell argument, command substitutions such as $(...) and backticks can still be evaluated. An attacker could also include a double quote to terminate the intended argument and append shell operators or additional commands. Consequently, the shell may interpret part of the prompt as executable syntax rather than passing it entirely as data to Hermes.

The package contains documentation and metadata rather than executable scripts, so exploitation depends on an invoking agent following the documented string-based exec pattern. Nevertheless, that pattern defines the skill's operational behavior and creates an unsafe code-execution boundary.

Attack Path

1. An attacker asks OpenClaw to consult Hermes and supplies a prompt containing shell syntax, such as a command substitution or quote-breaking payload.
2. OpenClaw inserts that prompt into the documented command template: ~/.local/bin/hermes chat -q "USER_PROMPT".
3. The exec tool passes the con ...[truncated 904 chars]

Remediation

View remediation

Remediation Suggestions

• Do not concatenate or interpolate prompt text into a shell command string.

• Invoke Hermes through an API that accepts an executable and argument array separately, with shell interpretation disabled. For example, use the conceptual argument vector:

  text

  ["~/.local/bin/hermes", "chat", "-q", prompt]
  

• Update SKILL.md to explicitly prohibit invoking the command through sh -c, bash -c, or an equivalent shell-evaluated string.

• If the available exec interface supports only command strings, replace it with a tool that supports structured arguments. Shell escaping should be treated only as a fallback and must use a well-tested, platform-appropriate quoting implementation rather than manual replacement.

• Apply least privilege to the OpenClaw process and Hermes CLI. Restrict access to sensitive files, credentials, network resources, and administrative commands to reduce the impact of any execution flaw.

• Add tests using prompts containing embedded quotes, semicolons, newlines, backticks, $(), redirection operators, and shell logical operators. Verify that every payload reaches Hermes as one literal argument and causes no shell-side execution.

• Consider setting execution timeouts and output-size limits and validating the expected Hermes executable path before invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description does not warn users that their prompt will be sent to a separate local agent process via CLI, which is a distinct trust boundary and may expose sensitive input to another tool, persona, or logging surface. This lack of transparency increases the risk of unintentional data disclosure and prevents informed consent before forwarding potentially sensitive requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

text

## Examples
If the user asks you to "ask Hermes to write a quick script" or "see what Hermes thinks about this":

1. Call the `exec` tool:
   - `command`: `~/.local/bin/hermes chat -q "Write a quick Python script to monitor system load"`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill uses broad invocation phrases like "see what Hermes thinks about this," which can cause the bridge to trigger on ordinary conversation rather than explicit user intent to delegate to another agent. Because the skill forwards prompts to a separate local CLI agent, accidental activation can leak user content or cause unreviewed actions to be proposed or performed in a different execution context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.