conclave

• Outcome: Review
• Latest audit: Aug 16, 2026 · 9:35 PM UTC
• Version: 1.6.7

Overview

The skill is mostly transparent about its behavior, but it grants broad environment-changing authority and mandatory data retention/export that users should review carefully before installing.

Install only if you are comfortable with global CLI installs and updates, multiple third-party AI providers receiving debate content, local auth-state checks, and full debate archives being retained and copied into your working directory. Use check-only/skip-update modes where possible, avoid sensitive topics, and run debates from an isolated directory that is not public, synced, or shared.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill’s declared purpose is debate orchestration, but the content explicitly authorizes package installation, global updates, credential-state inspection, persistent archival, cleanup/deletion, and mandatory export to the working directory. That gap is security-relevant because users may invoke it expecting reasoning assistance while it performs privileged system changes and broad data handling operations beyond the stated core function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file explicitly instructs operators to bypass the described MCP-only integration and use the Manus REST API directly with the same API key. That broadens the skill's capability surface and enables direct exfiltration of debate content and polling of third-party results outside the originally constrained tool path, increasing privacy and governance risk.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

action "~/.codex/config.toml missing — create it with requires_openai_auth / wire_api / base_url per references/panelists.md."
  fi
else
  action "Codex auth missing — place the API key in ~/.codex/auth.json and set base_url in ~/.codex/config.toml (see references/panelists.md)."
fi

echo "-- Gemini CLI --"

• Confidence: 82% confidence
• Finding: ~/.codex/config.toml

External Transmission

Medium

• Category: Data Exfiltration

Content

- Ping: send a minimal task "reply with one word: pong" (mode="speed"); receiving a task_id means the channel is open.
- 2026-08-12 verified: this MCP only exposes create_task / create_webhook / delete_webhook.
  **There is no MCP tool to query task results. BUT (2026-08-14 verified): the same MANUS_MCP_API_KEY works against the REST API directly, making results fully retrievable without webhooks:**
  - Create: `POST https://api.manus.im/v1/tasks` with header `API_KEY: <key>`, body `{"prompt": "...", "taskMode": "chat"}` → returns `task_id`.
  - Poll: `GET https://api.manus.im/v1/tasks/{task_id}` with the same header every 60s until `status == "completed"`; extract text from `output[]` where `role == "assistant"` → `content[].text`.
  - Typical review turnaround: ~3 minutes. This is the preferred path on CLI-only machines; keep the webhook/user-paste routes as fallbacks only.

• Confidence: 95% confidence
• Finding: https://api.manus.im/

External Transmission

Medium

• Category: Data Exfiltration

Content

- 2026-08-12 verified: this MCP only exposes create_task / create_webhook / delete_webhook.
  **There is no MCP tool to query task results. BUT (2026-08-14 verified): the same MANUS_MCP_API_KEY works against the REST API directly, making results fully retrievable without webhooks:**
  - Create: `POST https://api.manus.im/v1/tasks` with header `API_KEY: <key>`, body `{"prompt": "...", "taskMode": "chat"}` → returns `task_id`.
  - Poll: `GET https://api.manus.im/v1/tasks/{task_id}` with the same header every 60s until `status == "completed"`; extract text from `output[]` where `role == "assistant"` → `content[].text`.
  - Typical review turnaround: ~3 minutes. This is the preferred path on CLI-only machines; keep the webhook/user-paste routes as fallbacks only.

## General Rules

• Confidence: 95% confidence
• Finding: https://api.manus.im/

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

sudo dnf install -y nodejs npm
      elif have pacman; then
        info "installing node via pacman (may prompt for sudo password)..."
        sudo pacman -S --noconfirm nodejs npm
      else
        action "Node.js missing and no apt/dnf/pacman found. Install Node.js >= 18 via nvm: https://github.com/nvm-sh/nvm — then re-run this script."
        return 1

• Confidence: 88% confidence
• Finding: --noconfirm

Credential Access

High

• Category: Privilege Escalation

Content

This skill does **significantly more** than "debate orchestration". By design it:

- **Installs and updates global CLI tools** (`npm install -g`, brew, apt, etc.) via `scripts/install.sh` and pre-flight self-updates.
- **Inspects local auth state** (checks for API keys, OAuth tokens, keychain status) without reading secret values.
- **Transmits your debate topic** to 6 third-party AI cloud APIs (Claude/OpenAI, Google, Alibaba, ByteDance/Ark, Manus).
- **Persists full debate records** indefinitely under `~/.hermes/debates/` (briefs, raw agent outputs, verdicts, votes).
- **Mandatorily exports** the entire arena to the current working directory after every debate.

• Confidence: 90% confidence
• Finding: keychain

Credential Access

High

• Category: Privilege Escalation

Content

### 1. Four npm CLIs (auto-installed by install.sh)
| Panelist | Package | Auth the user must complete |
|----------|---------|------------------------------|
| Claude Code | `@anthropic-ai/claude-code` | Run `claude` once interactively, finish OAuth login. On macOS, unlock the login keychain in an interactive terminal before background debates. |
| Codex | `@openai/codex` | Put the API key in Codex's `auth.json` and set base_url/wire_api in its `config.toml` (see references/panelists.md). |
| Gemini CLI | `@google/gemini-cli` | Export `GEMINI_API_KEY` (and base URL if using a relay) in your shell rc. Key prefix decides the provider — do not mix official and relay keys. |
| Qwen | `@qwen-code/qwen-code` | Run `qwen` once interactively to log in, or export the API key/base URL in your shell rc. |

• Confidence: 86% confidence
• Finding: keychain

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo dnf install -y nodejs npm
      elif have pacman; then
        info "installing node via pacman (may prompt for sudo password)..."
        sudo pacman -S --noconfirm nodejs npm
      else
        action "Node.js missing and no apt/dnf/pacman found. Install Node.js >= 18 via nvm: https://github.com/nvm-sh/nvm — then re-run this script."
        return 1

• Confidence: 78% confidence
• Finding: sudo

Self-Modification

High

• Category: Rogue Agent

Content

This skill does **significantly more** than "debate orchestration". By design it:

- **Installs and updates global CLI tools** (`npm install -g`, brew, apt, etc.) via `scripts/install.sh` and pre-flight self-updates.
- **Inspects local auth state** (checks for API keys, OAuth tokens, keychain status) without reading secret values.
- **Transmits your debate topic** to 6 third-party AI cloud APIs (Claude/OpenAI, Google, Alibaba, ByteDance/Ark, Manus).
- **Persists full debate records** indefinitely under `~/.hermes/debates/` (briefs, raw agent outputs, verdicts, votes).

• Confidence: 98% confidence
• Finding: self-update

Self-Modification

High

• Category: Rogue Agent

Content

2. **Fill the brief**: write brief.md, mapping.md, and constraints.md under `01_brief/`.
3. **Version & parameter check**: see `references/panelists.md` (commands, parameters, auth pitfalls for each agent).
4. **Pre-flight (update + ignition)**: run `bash ~/.hermes/skills/conclave/scripts/preflight.sh <arena-path>`
   - Phase A: best-effort self-update of all panelist CLIs (failures are non-fatal and logged; `--skip-update` bypasses).
   - Phase B: ignition ping of all panelist agents (plus Manus, verified manually); results are auto-written to `00_preflight/preflight.log`.
   - Any ping failure: fix first (key / proxy / version), then debate.
5. **Launch the debate**: use `terminal(background=true)` to spawn the panelist CLIs in parallel, writing outputs to `02_r1/`.

• Confidence: 97% confidence
• Finding: self-update

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Initialize the arena**: run `bash ~/.hermes/skills/conclave/scripts/init_debate.sh <topic-slug>`
   - Auto-creates `~/.hermes/debates/conclave-YYYYMMDD-<slug>/`
   - Generates the full directory structure + starter template files (brief.md / mapping.md / constraints.md / index.md)
2. **Fill the brief**: write brief.md, mapping.md, and constraints.md under `01_brief/`.
3. **Version & parameter check**: see `references/panelists.md` (commands, parameters, auth pitfalls for each agent).
4. **Pre-flight (update + ignition)**: run `bash ~/.hermes/skills/conclave/scripts/preflight.sh <arena-path>`
   - Phase A: best-effort self-update of all panelist CLIs (failures are non-fatal and logged; `--skip-update` bypasses).

• Confidence: 94% confidence
• Finding: write brief.md, mapping.md, and constraints.md under `01_brief/`. 3. **Version & parameter check**: see `references/panelists.md` (commands, parameters, auth pitfalls for each agent). 4. **Pre-flight

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

sudo dnf install -y nodejs npm
      elif have pacman; then
        info "installing node via pacman (may prompt for sudo password)..."
        sudo pacman -S --noconfirm nodejs npm
      else
        action "Node.js missing and no apt/dnf/pacman found. Install Node.js >= 18 via nvm: https://github.com/nvm-sh/nvm — then re-run this script."
        return 1

• Confidence: 89% confidence
• Finding: --noconfirm

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.