Security audit

Hermes Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is a broad Hermes control reference with no malicious code, but it should be reviewed because it documents disabling approvals, debug uploads, webhooks, background agents, and persistence with limited safety guidance.

Install only if you intend to let OpenClaw use Hermes as a broad automation controller. Keep approvals enabled unless you are in an isolated test environment, keep secret and PII redaction on where possible, review debug reports before upload, avoid exposing webhooks beyond localhost without authentication, and be cautious with cron jobs, background agents, and gateway services that can keep acting after the original session.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation prominently includes `--yolo` as a global flag to skip dangerous command confirmation, but does not pair it with a strong warning about the security implications. In a skill meant to help fully control an agent, normalizing confirmation bypass increases the chance of unsafe command execution, especially when combined with terminal, browser, gateway, or automation features.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The `/debug` command uploads system information and logs to an external service, but the documentation does not warn that potentially sensitive local metadata may be transmitted. In a control skill covering credentials, sessions, gateway logs, and automation, this omission can lead to inadvertent disclosure of secrets, tokens, file paths, or personal data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents how to disable secret redaction with no prominent warning, which directly increases the risk of secrets being exposed in logs, prompts, gateway messages, debug output, or screenshots. Because this skill centralizes full agent control and references `.env`, auth storage, and remote platforms, disabling redaction materially raises credential leakage risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation shows how to disable PII redaction without warning about privacy consequences. Since Hermes can operate across messaging platforms, webhooks, logs, and memory features, turning off redaction can expose personal information to external systems or long-term storage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents `approvals.mode off` and equates it with `--yolo` without a clear, immediate warning that this disables command confirmations. In a skill for full automation and agent control, removing approval gates significantly increases the chance of destructive or externally triggered actions being executed without human review.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The webhook example shows a local endpoint that can trigger agent actions, but does not warn about authentication, authorization, or network exposure. If this endpoint is reachable by other local users, containers, tunnels, or misconfigured network bindings, it could allow unauthorized task execution through Hermes.

Static analysis

No suspicious patterns detected.