ClawHub

Conto Hermes

Security checks across malware telemetry and agentic risk

Overview

This is a coherent payment-policy skill, but it gives an agent live payment and policy-administration authority with weak local confirmation and credential-storage safeguards.

Review before installing. Use a Standard SDK key for routine payment checks, reserve Admin keys for short controlled policy-management sessions, protect ~/.hermes/.env with restrictive permissions or a secret manager, verify CONTO_API_URL points to the trusted Conto endpoint, start with low/testnet limits, and require your own explicit confirmation before any real transfer or policy deletion.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (12)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill claims to enforce spending policies before payments, but it also exposes full policy administration endpoints that can create, modify, or delete policies and rules. In an agent setting, this broadens the tool from guardrail enforcement into guardrail reconfiguration, which can let a compromised or overly-permissive workflow weaken or remove protections before spending.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The setup flow starts a local callback server, opens a browser, receives credentials through a localhost redirect, and persists them for future use. Those capabilities exceed simple policy checking and introduce additional attack surface around credential capture, local interception, and unauthorized persistence in an agent environment.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to store a sensitive Conto SDK key, including an Admin-capable key, in a local .env file but does not warn that this credential grants policy-management or payment-approval capabilities and must be protected from source control, logs, shell history, backups, and other local compromise paths. In a wallet/payment-control skill, mishandling this key could let an attacker read or modify policies, approve transactions, or otherwise interfere with spending controls.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The CLI example includes a natural-language payment command ("Send 50 pathUSD...") without a prominent warning that it may initiate a real transfer if the surrounding agent/tooling is connected to a funded wallet. Because this skill operates in a payments context and can auto-activate on natural language, users may copy-paste examples thinking they are illustrative when they are potentially transactional.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs saving a long-lived SDK key to ~/.hermes/.env without an explicit warning about persistence, file permissions, multi-user access, backup leakage, or key rotation. Storing payment/admin credentials on disk can expose them to other local processes, users, logs, or accidental commits, which is especially sensitive given this key can authorize payment-policy and potentially admin operations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script writes a newly obtained SDK key to ~/.hermes/.env without an explicit warning or confirmation at the point of persistence. Silent credential storage can surprise users, increase exposure on shared systems, and leave durable secrets available to other processes or future sessions.

Credential Access

High
Category
Privilege Escalation
Content
exit 1
    fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"
Confidence
90% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

    # Update or append CONTO_SDK_KEY and CONTO_API_URL in .env
Confidence
90% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

    # Update or append CONTO_SDK_KEY and CONTO_API_URL in .env
    if [[ -f "$HERMES_ENV" ]]; then
      # Remove existing Conto entries
      grep -v '^CONTO_SDK_KEY=' "$HERMES_ENV" | grep -v '^CONTO_API_URL=' > "${HERMES_ENV}.tmp" || true
Confidence
88% confidence
Finding
.env

Session Persistence

Medium
Category
Rogue Agent
Content
exit 1
    fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"
Confidence
87% confidence
Finding
Write to ~/.hermes

Tool Parameter Abuse

High
Category
Tool Misuse
Content
delete-policy)
    policy_id="${2:?policy_id required}"
    _conto_request DELETE "/api/policies/$policy_id"
    ;;

  get-rules)
Confidence
92% confidence
Finding
DELETE "/api/policies/$policy_id

Tool Parameter Abuse

High
Category
Tool Misuse
Content
delete-rule)
    policy_id="${2:?policy_id required}"
    rule_id="${3:?rule_id required}"
    _conto_request DELETE "/api/policies/$policy_id/rules/$rule_id"
    ;;

  setup)
Confidence
92% confidence
Finding
DELETE "/api/policies/$policy_id/rules/$rule_id

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal