Security audit

hermes-time-awareness

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it adds current time and idle-time context to Hermes LLM turns without unrelated access or hidden behavior.

Install only if you want every Hermes model call to receive a small time and idle-duration context block. Review the installer first if you are cautious about scripts that write under ~/.hermes/plugins and enable plugins automatically; note that Python 3.9+ is effectively required by the code and doctor script despite one artifact mentioning 3.8+.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: __init__.py:20