Hermes Control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 2.0.1

Overview

This Hermes control skill is mostly a coherent reference guide, but it includes unsafe installation and high-impact automation instructions without enough guardrails.

Install only if you trust the Hermes publisher and understand that this skill can guide broad local and remote agent administration. Avoid the curl-to-bash installer unless you independently verify it, prefer pinned versions, keep approvals in smart or manual mode, do not use --yolo for untrusted tasks, review debug reports before upload, and audit any gateway service or cron job you create.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:35

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

# Install using the recommended official installation script
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

Technical Analysis

The installation command streams content from an external URL directly into bash. The downloaded script is not included in the audited project and is not pinned to an immutable release, checksum, or cryptographic signature. Consequently, the effective code executed by this instruction can change at any time after the Skill has been reviewed.

HTTPS provides transport encryption and server authentication, but it does not guarantee that the hosted installer remains unchanged or benign. Compromise of the hosting service, publishing pipeline, domain, or installer source could cause arbitrary attacker-controlled shell commands to be returned and immediately executed.

This behavior is not the minimum privilege necessary to install the declared software. A safer installation flow can download a versioned artifact, verify its integrity and provenance, and execute it only after verification.

Attack Path

1. An attacker compromises the installer hosting origin, its deployment pipeline, or another component capable of changing the response from the documented URL.
2. The attacker modifies install.sh to include arbitrary shell commands.
3. A user or Agent follows the installation instruction in SKILL.md.
4. curl downloads the modified response and pipes it directly to bash.
5. The malicious commands execute with all permissions held by the invoking account.
6. The payload can inspect or modify user-accessible files, install additional software, establish persistence, or access credentials available to that account.

Impact Assessment

Successful exploitation provides arbitrary co ...[truncated 705 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash installation command.
• Prefer a version-pinned package or immutable release artifact from a verified publisher.
• If a shell installer is required, use a staged process:
  1. Download the installer to a local file.
  2. Verify a publisher signature or a SHA-256 checksum obtained through a trusted, independent channel.
  3. Inspect the script before execution.
  4. Execute it without elevated privileges unless a specific installation step requires elevation.
• Pin the installer URL to a reviewed release rather than a mutable generic endpoint.
• Publish signed release checksums and document signature verification.
• Run installation in an isolated environment with access limited to the files and credentials strictly required.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Python Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 38
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Alternative installation through PyPI
pip install hermes-agent

Technical Analysis

The alternative installation command does not specify an audited package version, dependency lock file, package hashes, or an isolated environment. Package resolution therefore selects the version and transitive dependency set available when the command is executed.

This makes installation non-reproducible and allows the effective code to change after the Skill audit. A compromised publisher account, malicious future release, or compromised transitive dependency could introduce code that executes during installation or when Hermes is subsequently invoked.

The finding is limited to absent dependency pinning and integrity controls. The audit did not identify evidence that the package currently published under this name is malicious.

Attack Path

1. An attacker compromises the package publisher, release process, package registry account, or a transitive dependency.
2. The attacker publishes a malicious package or dependency version that satisfies unconstrained resolution.
3. A user follows the unpinned pip install hermes-agent instruction.
4. pip resolves and downloads the attacker-controlled release.
5. Malicious package behavior executes during installation, import, startup, or later Hermes operations.
6. The package gains access to resources available to the Python process and invoking user.

Impact Assessment

Exploitation can result in arbitrary code execution under the invoking account. Potentially affected resources include user files, project data, Python environments, shell configuration, and credentials readable by that account.

Installing into a system Python environment or running pip with administrative privileges would increas ...[truncated 223 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Hermes Agent to a specifically reviewed release, such as hermes-agent==<reviewed-version>.
• Use a lock file containing exact transitive dependency versions.
• Require package hashes, for example through a hash-locked requirements file and pip --require-hashes.
• Verify the publisher and release provenance before updating the pinned version.
• Install the package inside a dedicated virtual environment rather than the system Python environment.
• Avoid administrative installation unless explicitly required.
• Establish a controlled update process that reviews release notes, dependency changes, signatures, and hashes before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends curl ... | bash, which fetches and immediately executes a remote script with no review, pinning, or integrity verification. If the remote host, TLS trust chain, or delivered script is compromised, arbitrary code executes on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash

# 安装（推荐官方安装脚本）
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

# 或通过 PyPI
pip install hermes-agent

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The pipe to bash specifically enables direct command chaining from a network response into a shell, eliminating review boundaries and magnifying any upstream compromise into immediate code execution. In a skill intended to automate control of an agent, this pattern is especially dangerous because users may follow it in high-trust automation contexts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash

# 安装（推荐官方安装脚本）
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

# 或通过 PyPI
pip install hermes-agent

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

hermes config edit               # 在 $EDITOR 中打开 config.yaml
hermes config set KEY VAL        # 设置配置值
hermes config path               # 打印 config.yaml 路径
hermes config env-path           # 打印 .env 路径
hermes config check              # 检查缺失/过时配置
hermes config migrate            # 更新配置新选项
hermes doctor [--fix]            # 检查依赖与配置

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

hermes config edit               # 在 $EDITOR 中打开 config.yaml
hermes config set KEY VAL        # 设置配置值
hermes config path               # 打印 config.yaml 路径
hermes config env-path           # 打印 .env 路径
hermes config check              # 检查缺失/过时配置
hermes config migrate            # 更新配置新选项
hermes doctor [--fix]            # 检查依赖与配置

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

hermes config edit               # 在 $EDITOR 中打开 config.yaml
hermes config set KEY VAL        # 设置配置值
hermes config path               # 打印 config.yaml 路径
hermes config env-path           # 打印 .env 路径
hermes config check              # 检查缺失/过时配置
hermes config migrate            # 更新配置新选项
hermes doctor [--fix]            # 检查依赖与配置

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 647)May include surrounding context.

md

hermes config edit               # 在 $EDITOR 中打开 config.yaml
hermes config set KEY VAL        # 设置配置值
hermes config path               # 打印 config.yaml 路径
hermes config env-path           # 打印 .env 路径
hermes config check              # 检查缺失/过时配置
hermes config migrate            # 更新配置新选项
hermes doctor [--fix]            # 检查依赖与配置

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation description is extremely broad and targets any request about controlling Hermes Agent, which can cause this powerful skill to be invoked in many contexts where only partial or safer guidance is needed. Because the skill includes commands for package install, approvals bypass, gateway management, webhooks, and automation, over-triggering increases the chance of unsafe actions being surfaced or followed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document advertises --yolo and other confirmation-bypass/destructive capabilities without strong warnings, preconditions, or examples of safe usage boundaries. In an automation-control skill, that materially lowers operator friction for bypassing approval gates and can lead to accidental or unauthorized execution of risky actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The /debug command is described as uploading system information and logs to obtain a shareable link, but the skill does not clearly warn that those artifacts may contain sensitive host details, tokens, file paths, prompts, or user data. This omission can lead users to transmit sensitive operational data externally without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill documents creation and management of persistent scheduled tasks, which can run prompts and deliveries over time with little emphasis on governance, review, or abuse prevention. In a powerful automation skill, persistent jobs materially expand blast radius by enabling unattended repeated actions, data collection, or message delivery after the initial session ends.

Content

Scanner excerpt · SKILL.md (reported line 590)May include surrounding context.

CLI 定时任务

bash

hermes cron create "0 9 * * *"          # 交互式创建
hermes cron list
hermes cron edit job_123
hermes cron pause job_123

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill recommends invoking an MCP server package via npx without pinning a specific version or integrity. That creates a supply-chain risk: future package updates or a compromised upstream release could execute unintended code when users follow the instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 765)May include surrounding context.

bash

# 发送消息触发代理
curl -X POST http://localhost:8080/webhooks/my-webhook \
  -H "Content-Type: application/json" \
  -d '{"text": "Run the daily report"}'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 799)May include surrounding context.

md

- **Discord 机器人静默**：必须在 Bot → Privileged Gateway Intents 启用 **Message Content Intent**
- **Slack 仅 DM 工作**：必须订阅 `message.channels` 事件
- **Windows 网关随 SSH 登出死亡**：`sudo loginctl enable-linger $USER`
- **WSL2 网关关闭**：`/etc/wsl.conf` 设置 `systemd=true`
- **网关崩溃循环**：`systemctl --user reset-failed hermes-gateway`

Static analysis

No suspicious patterns detected.