Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed read-only balance checker that uses local provider credentials to query AI billing endpoints and keeps an optional local trend log.
Install only if you are comfortable letting the skill read AI provider API keys, Codex/Grok CLI auth files, and CodexBar usage data to check balances. Use --no-log if you do not want balance snapshots written locally for trend history.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Even if implementation details are not visible here, the skill text states it reads environment variables and .env files to resolve credentials while declaring no tool scope. That combination is security-relevant because users may invoke a seemingly simple balance tool without being warned it performs local secret discovery.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
4. CodexBar CLI (macOS menu-bar app) for web-session providers
5. Interactive fallback: the tool prints the login URL and exits non-zero
Security rules baked into the code: OAuth access tokens are never refreshed or
rewritten (re-refreshing would rotate the CLI's own refresh token and log you
out), secrets are never echoed in any output mode, and there is no telemetry.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
4. CodexBar CLI (macOS menu-bar app) for web-session providers
5. Interactive fallback: the tool prints the login URL and exits non-zero
Security rules baked into the code: OAuth access tokens are never refreshed or
rewritten (re-refreshing would rotate the CLI's own refresh token and log you
out), secrets are never echoed in any output mode, and there is no telemetry.
This function is explicitly designed to access secrets from environment variables, which commonly include API keys and tokens. In an agent skill context, generic credential access is dangerous because any downstream code that can call this helper may extract unrelated secrets from the host runtime, not just the credits APIs needed for normal operation.
return process.env.HERMES_HOME ?? join(homedir(), ".hermes");
}
/** Read one key from the process env, then $HERMES_HOME/.env (never exported). */
export function hermesEnv(name: string): string | undefined {
const fromProcess = Bun.env[name];
if (fromProcess) return fromProcess;
Reading $HERMES_HOME/.env directly expands the skill's reach beyond process-scoped configuration into local secret files, which may contain credentials for many unrelated services. This broad local file-based secret access materially increases the blast radius if the skill or a dependent module is abused, because secrets can be harvested from disk even when not exported into the process environment.
const fromProcess = Bun.env[name];
if (fromProcess) return fromProcess;
try {
const lines = fs.readFileSync(join(hermesHome(), ".env"), "utf8").split("\n");
for (const raw of lines) {
const line = raw.trim();
if (!line.startsWith(`${name}=`)) continue;
The code path starting at this location establishes a mechanism to fetch secrets from runtime environment variables and a local private .env file. That is a credential access capability, and in an agent skill context it is dangerous because it allows the skill to consume locally stored API keys or tokens that may belong to multiple services, increasing blast radius if the skill is compromised or over-privileged.
return process.env.HERMES_HOME ?? join(homedir(), ".hermes");
}
/** Read one key from the process env, then $HERMES_HOME/.env (never exported). */
export function hermesEnv(name: string): string | undefined {
const fromProcess = Bun.env[name];
if (fromProcess) return fromProcess;
This line reads $HERMES_HOME/.env directly from disk and parses out named entries, which is direct access to a private credential store. In the context of a credit-checking skill, that capability is especially sensitive because it can harvest API keys for many providers from a central file, and any downstream bug or malicious modification could expose them.
const fromProcess = Bun.env[name];
if (fromProcess) return fromProcess;
try {
const lines = fs.readFileSync(join(hermesHome(), ".env"), "utf8").split("\n");
for (const raw of lines) {
const line = raw.trim();
if (!line.startsWith(`${name}=`)) continue;
Although this specific line is in the error-handling/return path, it is part of the same secret-loading routine that silently attempts to read a private .env file. Silent fallback behavior can make credential access harder to audit and detect, increasing the chance that sensitive local secrets are consumed without clear user awareness.
if (value) return value;
}
} catch {
// .env missing or unreadable — treated as "not set"
}
return undefined;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
tokens?: { access_token?: string; account_id?: string };
}
/** Read-only: the access token is used as-is; NEVER refreshed (refreshing would
* rotate the Codex CLI's own refresh token and log the user out). */
export const codexProvider: Provider = {
id: "codex",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
tokens?: { access_token?: string; account_id?: string };
}
/** Read-only: the access token is used as-is; NEVER refreshed (refreshing would
* rotate the Codex CLI's own refresh token and log the user out). */
export const codexProvider: Provider = {
id: "codex",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
tokens?: { access_token?: string; account_id?: string };
}
/** Read-only: the access token is used as-is; NEVER refreshed (refreshing would
* rotate the Codex CLI's own refresh token and log the user out). */
export const codexProvider: Provider = {
id: "codex",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
tokens?: { access_token?: string; account_id?: string };
}
/** Read-only: the access token is used as-is; NEVER refreshed (refreshing would
* rotate the Codex CLI's own refresh token and log the user out). */
export const codexProvider: Provider = {
id: "codex",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
});
describe("hermesEnv", () => {
test("reads from $HERMES_HOME/.env when not in process env", () => {
delete process.env.CAIC_TEST_KEY_DO_NOT_USE;
fs.writeFileSync(path.join(tmp, ".env"), `${KEY}="from-file-value"\nOTHER=1\n`, "utf8");
process.env.HERMES_HOME = tmp;
Detected: suspicious.dangerous_exec