FSB Skill

• Outcome: Review
• Latest audit: Jul 7, 2026 · 6:04 AM UTC
• Version: 0.9.90

Overview

This skill is a disclosed browser-automation integration that can control the user's real Chrome session, but its high-privilege behavior is purpose-aligned and includes user confirmation guidance for sensitive final actions.

Install this only if you want an agent to operate your real Chrome session. Review each host-config prompt, consider pinning fsb-mcp-server instead of using the latest npx package, and require explicit confirmation before any purchase, payment, account change, deletion, permission grant, settings write, or public post.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The installer writes to ~/.hermes/config.yaml, modifying a third-party application's persistent local configuration. Although it prompts before writing, this exceeds the narrowly stated runtime behavior of driving Chrome via an extension/MCP bridge and creates an additional persistence surface in another tool's config that users may not expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Directly editing ~/.hermes/config.yaml grants the skill a capability to alter another local application's behavior, which is not clearly justified by the described web-task purpose. This creates persistent cross-application effects and could be abused to register unexpected commands or change future execution paths in Hermes.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill strongly biases the agent to escalate nearly any website-related task to a live browser connected to the user's real Chrome session, including cookies, logged-in state, and saved credentials. This increases unnecessary exposure to high-privilege tooling and can cause the agent to access or act within sensitive authenticated contexts when lower-risk read-only tools would suffice.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The worked example instructs the agent to add an item to cart without any reminder to pause for user confirmation before taking a commerce-affecting action. In a browser-driving skill, examples strongly influence model behavior, so this can normalize unauthorized transactional steps and increase the chance of acting in a logged-in shopping context without explicit consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

writeFileSync(HERMES_CONFIG_PATH, newContent, 'utf8');
  } catch (err) {
    process.stdout.write(
      '[FAIL] could not write ~/.hermes/config.yaml: ' + (err && err.message ? err.message : String(err)) + '\n'
    );
    return { status: 'failed' };
  }

• Confidence: 88% confidence
• Finding: write ~/.hermes/config.yaml: ' + (err && err.message ? err.message : String(err)) + '\n' ); return { status: 'failed' }; } process.stdout.write('[OK] wrote mcp_servers.fsb into ~/.hermes

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/install-host.mjs:94