Security audit

Hermes Workflow Engine

Security checks across malware telemetry and agentic risk

Overview

This workflow skill is powerful and mostly disclosed, but it needs review because it includes unsafe credential-copy guidance, broad auto-trigger behavior, session-history scanning, and an unsafe community import path.

Install only if you are comfortable with a powerful workflow orchestrator. Review workflows before running them, avoid importing untrusted community archives, do not follow the private-key or token-copy instructions, and disable or avoid history-based and automatic trigger features unless you explicitly want that behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill claims automatic scheduled, event-driven, tool-sequence, and message-triggered execution beyond explicit user-invoked workflow runs. In a workflow engine with shell, file, delegation, and community features, such autonomous triggering can cause unintended actions to occur without clear contemporaneous approval.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Community publish/import/export/install/rating features enlarge the trust boundary from local orchestration to supply-chain style content exchange. Importing or installing shared workflows can introduce unreviewed prompts, commands, or automation logic that may later execute with the engine's powerful capabilities.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Automatic scanning of session history to detect patterns exceeds the minimum scope needed to execute a requested workflow. This creates privacy and behavioral-profiling risk because prior conversations and tool usage may be mined to infer tasks or triggers the user did not explicitly ask to automate.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This reference document includes explicit instructions to copy authentication material from a remote server, including an SSH private key and a ClawHub token, which is unrelated to normal workflow-engine functionality and materially increases the chance of credential compromise. In the context of a broadly installable skill, these steps normalize secret sharing and could lead users to reuse privileged credentials across hosts and accounts.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The publishing and GitHub setup content extends beyond the stated workflow-orchestration purpose of the skill and may encourage users to perform repository and release operations they did not intend. While this is more of a scope-expansion and supply-chain hygiene issue than direct exploitation, bundling unrelated publishing instructions in the skill increases operational risk and confusion.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The document goes beyond workflow-engine deployment and includes instructions to transfer existing authentication material and SSH keying assets between servers. For a workflow orchestration skill, this expands scope into credential handling in a way that can normalize insecure secret movement and lead to account compromise or unauthorized publishing/repository access.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Copying a ClawHub auth config from another machine instructs operators to reuse bearer credentials outside their original host boundary, which can expose tokens and bypass normal enrollment or audit controls. This is unjustified by the skill's deployment purpose and creates a direct path to account misuse if the destination or transfer path is compromised.

Context-Inappropriate Capability

Critical

Confidence: 100% confidence
Finding: The guide explicitly tells the user to copy a GitHub SSH private key from another server and configure it for use on the destination host. Private key duplication breaks key custody, increases the attack surface, and can enable persistent unauthorized access to source repositories if either system is compromised.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The document provides concrete commands for SSHing as root to a hard-coded external IP, creating directories under /root, copying code, and modifying files remotely. In a skill package, this is dangerous because it enables direct cross-system administrative actions unrelated to ordinary workflow orchestration and could normalize or facilitate unauthorized deployment to third-party infrastructure.

Intent-Code Divergence

Low

Confidence: 93% confidence
Finding: The guide claims it is only adapting paths for deployment, but it also instructs changing the author attribution from one name to another. That discrepancy is a red flag because it introduces identity/ownership tampering unrelated to technical portability and may conceal provenance of the skill when moved to another system.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The history detector reads local session JSON files and aggregates prior user messages to infer behavioral patterns without any consent, minimization, or scope checks. That creates a privacy and data-governance issue because the component repurposes stored conversational data for profiling and workflow triggering beyond the immediate user request.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: External event types such as email receipt, PR creation, and alerts are mapped directly to workflows with no authentication, provenance validation, tenant scoping, or replay protection shown in this file. If an attacker can spoof or inject events into the caller path, they may trigger sensitive automations like email handling or code review on unintended data.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The import logic writes archive members to disk using paths derived directly from the tar entry name after stripping only the first path component. A crafted archive member such as `name/../../.bashrc` or one containing nested traversal segments can escape `wf_dir` and overwrite arbitrary files writable by the current user, which is a classic archive path traversal issue. In this workflow-engine context, importing community packages makes the bug more dangerous because users are expected to consume semi-trusted shared archives.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Generic skill steps are granted broad toolsets ('terminal', 'file', 'web') by default, which exceeds what a workflow orchestrator necessarily needs and can let an untrusted or loosely specified skill perform filesystem access, command execution, or network actions. In this skill context, the engine is explicitly designed to automate multi-step workflows and delegate execution, so overbroad default privileges materially increase the blast radius of prompt injection, misconfiguration, or malicious workflow definitions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The automatic fallback mapping routes multiple logical operations to shell-capable paths such as 'terminal:cat', 'terminal:echo', and 'terminal:curl', and even cross-maps 'terminal' with 'execute_code'. This is dangerous because a failure in a higher-level tool can silently degrade into command execution, turning ordinary workflow actions into shell-enabled behavior without an explicit user approval boundary.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger set includes broad phrases like '自动化任务' and '多步骤任务' that overlap with ordinary user requests. In a skill capable of shell execution and delegation, overly broad triggers increase the risk of accidental activation and unintended privileged behavior.

Vague Triggers

High

Confidence: 96% confidence
Finding: The listed trigger phrases include common expressions and English variants that can match benign conversations. Because the skill can validate, plan, execute, and delegate workflows, accidental routing into this engine could initiate consequential actions the user did not intend.

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill states it will auto-match user intent without explicit trigger words across very broad categories like deployment, backup, email, and code review. This is dangerous because ordinary requests may be silently reframed as automation workflows, expanding from assistance into autonomous action selection.

Vague Triggers

High

Confidence: 98% confidence
Finding: Tool-sequence, time-pattern, history-pattern, and event-driven triggers are described with minimal constraints and can infer future automation from prior behavior. In combination with stateful storage and powerful execution modes, that creates a substantial risk of non-consensual or surprising workflow activation.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The markdown instructs users to copy a private SSH key from a remote host into their local ~/.ssh directory and configure Git to use it, without any warning about the sensitivity of private key material. This can compromise both the source host and the local machine, defeats identity separation, and enables unauthorized GitHub access if the key is shared or later leaked.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The document tells users to import a ClawHub config containing authentication token material from another server, again without any warning or access-control guidance. This promotes credential reuse, bypasses user accountability, and can expose a shared token that grants unauthorized publishing or account actions.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The text directs the reader to copy authentication configuration containing tokens without any warning about secrecy, host trust, or lifecycle management. That omission makes unsafe handling appear routine and materially raises the chance of credential disclosure or reuse across environments.

Missing User Warnings

Critical

Confidence: 100% confidence
Finding: The document instructs users to copy a private SSH key and then wire it into SSH config, with no warning that disclosure of the private key can grant repository access and enable impersonation. Presenting this as normal operational guidance is highly dangerous because it promotes irreversible key sprawl and secret leakage.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The instructions perform impactful remote actions including directory creation, file transfer, archive extraction, and in-place edits on a target host without any warning, confirmation, rollback guidance, or authorization checks. This increases the chance of accidental system modification and makes the skill more dangerous in an automation context, where users may copy commands without understanding the effects.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The format explicitly supports `terminal` steps that execute arbitrary shell commands and `file` outputs that write to paths derived from template variables, but it provides no warning, restriction guidance, or safety model. In a workflow engine skill whose purpose is multi-step automation, this can normalize unsafe workflows and enable command execution or filesystem modification from untrusted workflow definitions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.