Conto Hermes

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.8.0

Overview

This is a coherent payment-policy skill, but it gives an agent live payment and policy-administration authority with weak local confirmation and credential-storage safeguards.

Review before installing. Use a Standard SDK key for routine payment checks, reserve Admin keys for short controlled policy-management sessions, protect ~/.hermes/.env with restrictive permissions or a secret manager, verify CONTO_API_URL points to the trusted Conto endpoint, start with low/testnet limits, and require your own explicit confirmation before any real transfer or policy deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill claims to enforce spending policies before payments, but it also exposes full policy administration endpoints that can create, modify, or delete policies and rules. In an agent setting, this broadens the tool from guardrail enforcement into guardrail reconfiguration, which can let a compromised or overly-permissive workflow weaken or remove protections before spending.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The setup flow starts a local callback server, opens a browser, receives credentials through a localhost redirect, and persists them for future use. Those capabilities exceed simple policy checking and introduce additional attack surface around credential capture, local interception, and unauthorized persistence in an agent environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to store a sensitive Conto SDK key, including an Admin-capable key, in a local .env file but does not warn that this credential grants policy-management or payment-approval capabilities and must be protected from source control, logs, shell history, backups, and other local compromise paths. In a wallet/payment-control skill, mishandling this key could let an attacker read or modify policies, approve transactions, or otherwise interfere with spending controls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI example includes a natural-language payment command ("Send 50 pathUSD...") without a prominent warning that it may initiate a real transfer if the surrounding agent/tooling is connected to a funded wallet. Because this skill operates in a payments context and can auto-activate on natural language, users may copy-paste examples thinking they are illustrative when they are potentially transactional.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs saving a long-lived SDK key to ~/.hermes/.env without an explicit warning about persistence, file permissions, multi-user access, backup leakage, or key rotation. Storing payment/admin credentials on disk can expose them to other local processes, users, logs, or accidental commits, which is especially sensitive given this key can authorize payment-policy and potentially admin operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes a newly obtained SDK key to ~/.hermes/.env without an explicit warning or confirmation at the point of persistence. Silent credential storage can surprise users, increase exposure on shared systems, and leave durable secrets available to other processes or future sessions.

Credential Access

High

• Category: Privilege Escalation

Content

exit 1
    fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

• Confidence: 90% confidence
• Finding: This code persists an SDK credential in a plaintext environment file under the user's home directory. Long-lived secrets stored this way are accessible to other local tooling, backups, or accidental disclosure, and they materially increase the blast radius if the host or account is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

    # Update or append CONTO_SDK_KEY and CONTO_API_URL in .env

• Confidence: 90% confidence
• Finding: The handling around ~/.hermes/.env shows direct credential persistence in a conventional plaintext config location. Such files are commonly read by other tools and may be copied into logs, backups, or support bundles, making credential compromise more likely and more damaging.

Credential Access

High

• Category: Privilege Escalation

Content

HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

    # Update or append CONTO_SDK_KEY and CONTO_API_URL in .env
    if [[ -f "$HERMES_ENV" ]]; then
      # Remove existing Conto entries
      grep -v '^CONTO_SDK_KEY=' "$HERMES_ENV" | grep -v '^CONTO_API_URL=' > "${HERMES_ENV}.tmp" || true

• Confidence: 88% confidence
• Finding: The update logic reads and rewrites the env file while preserving other content, which further entrenches the use of plaintext credential storage and may expose secrets during file operations. In a multi-process or shared environment, this can also create race conditions or leave temporary artifacts containing sensitive values.

Session Persistence

Medium

• Category: Rogue Agent

Content

exit 1
    fi

    # Write to ~/.hermes/.env
    HERMES_ENV="$HOME/.hermes/.env"
    mkdir -p "$(dirname "$HERMES_ENV")"

• Confidence: 87% confidence
• Finding: Writing the SDK key into ~/.hermes establishes persistent authorization beyond the current setup session. That persistence means any later process with access to the environment file can reuse the token to approve payments or administer policies, increasing the window for misuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

delete-policy)
    policy_id="${2:?policy_id required}"
    _conto_request DELETE "/api/policies/$policy_id"
    ;;

  get-rules)

• Confidence: 92% confidence
• Finding: The tool exposes a direct delete-policy operation that accepts an arbitrary policy ID and forwards it to the remote API. In an agent context, untrusted prompts or tool misuse could remove guardrail policies, enabling subsequent transfers that would otherwise be blocked.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

delete-rule)
    policy_id="${2:?policy_id required}"
    rule_id="${3:?rule_id required}"
    _conto_request DELETE "/api/policies/$policy_id/rules/$rule_id"
    ;;

  setup)

• Confidence: 92% confidence
• Finding: The delete-rule operation lets the caller remove individual policy rules by supplied identifiers, again without local safeguards. An attacker or prompt-injected workflow could selectively strip deny/limit rules while leaving the policy appearing intact, making evasion less obvious than deleting the full policy.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.