Workspace Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.2.0

Overview

This audit skill is mostly coherent, but it includes instructions that could change or delete important local agent data and route around execution/configuration controls.

Install only if you are comfortable reviewing each proposed repair manually. Treat it as a read-only audit by default, do not let it bypass blocked tools, and require explicit confirmation, backups, and exact file lists before any Hermes config, cron, database, archive, session, or log cleanup action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:137

Finding

Instructions Bypass Execution and Protected-Configuration Controls

Content

View full analysis

` instead for any config.yaml change (char_limit, auto_prune, etc.). ``` ### Technical Analysis The Skill explicitly treats tool denial and protected-file refusal as restrictions to route around. When `execute_code` is unavailable under a restricted cron profile, the instructions direct the Agent to write equivalent code into `/tmp` and execute it through `terminal`. When the patch tool refuses to modify security-sensitive Hermes configuration, the instructions recommend making the same change through the Hermes CLI. Controls applied according to tool identity or execution context are ineffective if the Skill can perform the denied operation through another interface. A legitimate audit can collect information and propose changes without bypassing an explicit denial. Executing arbitrary temporary scripts or changing ...[truncated 1623 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: scripts/audit_diagnose.py:164

Finding

Audit Remediation Recommends Installing a Persistent Nightly Agent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/hermes-audit-procedure.md:393

Finding

Checkpoint Cleanup Deletes Recent Files That Were Not Archived

Content

View full analysis

Remediation

View remediation

"$manifest" tar --null --files-from="$manifest" \ -czf session-checkpoints-archive-START_to_END.tar.gz tar -tzf session-checkpoints-archive-START_to_END.tar.gz # After explicit verification: xargs -0 -- rm -- < "$manifest" rm -- "$manifest" ``` For stronger recoverability, replace the deletion step with a move into a dated quarantine directory and retain it until a later, separately approved cleanup. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/hermes-audit-procedure.md:340

Finding

Coarse Date-Range Query Is Incorrectly Treated as Proof of Complete Session Redundancy

Content

View full analysis

0 for the full range → archive is 100% redundant ``` The procedure then permits permanent deletion: ```bash cd ~/.hermes/sessions/ tar -czf archive-YYYY-MM-DD_to_YYYY-MM-DD.tar.gz -C archive/ . # Verify integrity BEFORE deleting originals tar -tzf archive-*.tar.gz | wc -l # should match original file count rm -rf archive/ ``` ### Technical Analysis The database test establishes only that at least one message exists before a chosen timestamp. It does not prove that every archived session, message, checkpoint, transcript field, attachment reference, or metadata record is present in `state.db`. Even confirming that the minimum and maximum database timestamps cover the archive's date range would establish temporal overlap, not record-level equivalence. The conclusion that `overlapping_msgs > 0` means the archive is “100% redundant” is logically invalid. The subsequent archive listing verifies that a tar file can be enumerated, but it does not compare archived records against database records or neces ...[truncated 1452 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The code does perform an audit of a workspace, so it is adjacent in spirit to the declared purpose. However, its actual function is much narrower and materially different: it collects simple baseline file metrics from fixed workspace folders (e.g., MEMORY.md, memory/, references/, traces/, docs/), checks markdown front matter presence, detects duplicate dates, and estimates token counts. There is no evidence of DDIA-style reliability analysis, DDD bounded-context analysis, schema drift detection, consistency-gap diagnosis, query degradation assessment, lifecycle analysis beyond simple counts, or architectural coupling evaluation. The primary purpose is baseline content/structure measurement for a memory-oriented workspace, not the higher-level software-engineering system audit described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description suggests a broad architectural audit of Agent workspaces using DDIA reliability and DDD bounded-context analysis to detect schema drift, consistency gaps, query degradation, lifecycle bloat, and coupling. The supplied code does not implement that kind of analysis. Instead, it loads two baseline JSON files, compares a fixed set of memory-oriented metrics, checks for existence of specific scripts under scripts/memory, and emits a validation report. Its primary purpose is post-remediation verification of a prior memory audit, not a general workspace system audit. While there is some loose overlap with the idea of 'audit' and 'stale/bloated/inconsistent' workspace health, the implemented behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/ddia-ddd-mapping.md (reported line 48)May include surrounding context.

md

## Key Insight

Agent memory systems face the **same fundamental challenges** as distributed databases:
- Schema drift (free text without constraints)
- Replication lag (MEMORY.md not updated after status change)
- Split brain (multiple sources of truth for "current project status")
- Garbage collection (old decisions never cleaned)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This audit procedure goes beyond read-only diagnosis and includes filesystem mutation by moving session artifacts into an archive. In an agent skill intended for auditing, embedding remediation commands creates a path for unintended state changes, data hiding, and operational disruption if an agent executes the procedure automatically or without explicit user confirmation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The procedure instructs changing security-sensitive configuration and running VACUUM on the primary state database, which exceeds the scope of an audit. In an agent context, this can silently alter retention behavior, availability characteristics, and data layout, making the skill unsafe as an ostensibly diagnostic artifact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section prescribes direct editing of cron job definitions and resets delivery error state via an inline Python rewrite of jobs.json. Direct manipulation of scheduler state and error fields can destroy forensic evidence, break job routing, or misconfigure future deliveries, especially if executed by an autonomous agent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The procedure recommends compression and deletion operations across archives, session checkpoints, and logs, including rm and rm -rf commands. In a skill that may be consumed by an agent, these commands can cause irreversible data loss, remove debugging evidence, and destroy operational history under the guise of routine auditing.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The rm -rf archive/ command is a high-risk destructive operation that recursively deletes archived session material after a coarse verification step. If archive scope, working directory, or assumptions about redundancy are wrong, the deletion is irreversible and can remove evidence or user data at scale.

Content

Scanner excerpt · references/hermes-audit-procedure.md (reported line 373)May include surrounding context.

tar -czf archive-YYYY-MM-DD_to_YYYY-MM-DD.tar.gz -C archive/ .

Verify integrity BEFORE deleting originals

tar -tzf archive-*.tar.gz | wc -l # should match original file count rm -rf archive/

text

Typical result: 105MB / 428 files → 22MB / 1 tar.gz (79% reduction).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The command deletes rotated logs using a wildcard, which can erase troubleshooting and audit evidence without any confirmation or retention checks. In a system-audit skill, this is dangerous because logs are often the very artifacts needed to investigate faults, incidents, or abuse.

Content

Scanner excerpt · references/hermes-audit-procedure.md (reported line 420)May include surrounding context.

bash

# Delete rotated logs and old diagnostics
rm ~/.hermes/logs/*.log.1
rm ~/.hermes/logs/update.log ~/.hermes/logs/gateway-exit-diag.log
# Clean curator logs >14 days
find ~/.hermes/logs/curator/ -maxdepth 1 -type d -mtime +14 -exec rm -rf {} \;

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Deleting update.log and gateway-exit-diag.log directly can destroy diagnostic history and mask prior failures. Because these are named troubleshooting artifacts, their removal from within an audit procedure undermines observability and may interfere with incident response or root-cause analysis.

Content

Scanner excerpt · references/hermes-audit-procedure.md (reported line 421)May include surrounding context.

bash

# Delete rotated logs and old diagnostics
rm ~/.hermes/logs/*.log.1
rm ~/.hermes/logs/update.log ~/.hermes/logs/gateway-exit-diag.log
# Clean curator logs >14 days
find ~/.hermes/logs/curator/ -maxdepth 1 -type d -mtime +14 -exec rm -rf {} \;

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guidance explicitly instructs operators to bypass an execution restriction by writing Python to /tmp and invoking it via the terminal. This undermines the platform's safety boundary around blocked code execution and provides a reusable technique for evading execution controls, which is dangerous even in an audit context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs the agent to run audit scripts and perform file-moving or archival actions, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates a mismatch between declared trust boundaries and actual capabilities, increasing the risk of unintended file reads/writes if the skill is auto-invoked or reused in a broader environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text says the skill activates during periodic health checks or when the workspace 'feels stale, bloated, or inconsistent.' Phrases like 'feels stale' are subjective and broad, making it unclear when the skill should or should not activate and increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and primary descriptive content switch into Chinese with no indication that language selection is optional. This creates a language/locale policy issue because the skill appears to prescribe a specific language without explicit user opt-in or a documented regional requirement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill explicitly recommends writing ad-hoc Python to /tmp/script.py and executing it via the terminal. Using shared temporary locations for executable scripts can expose code or data to other local processes/users, create symlink or race-condition risks, and encourage persistence of sensitive audit logic or workspace-derived content outside the intended workspace boundary.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

- **False-positive duplicates (pre-v1.1):** The original baseline script flat-listed `memory/*.md` + `memory/archive/*.md` + `memory/clawcast/*.md` together and computed duplicate dates across the union. This reported 48 "duplicates" when only 3 were real file-name collisions — the rest were a daily log and a same-day clawcast note legitimately coexisting. Fixed in v1.1: duplicates are now detected per-category and tagged `category:date`. If you ever adapt this script to a new workspace, keep the per-category isolation; do not collapse back to a flat list.
- **"Same FM date" ≠ "duplicate file".** A daily log and a topical note (travel, reading, study) can share a date because multiple things happen in a day. Check filename *and* content type before merging — if the filenames differ meaningfully, they are almost certainly not duplicates.
- **Subdirectory FM coverage is intentionally low.** `archive/`, `diary/`, `agent-productivity/` historically have little or no front matter. This is expected and not a P0. Chase the `toplevel` FM coverage to 100% first; subdirectory FM is a P3/P4 cleanup at best.
- **execute_code blocked under cron profile.** When running this audit from a cron job (or any session with `approvals.cron_mode: approve`), `execute_code` is denied. Write ad-hoc Python to `/tmp/script.py` and run it via `terminal` instead — the baseline/diagnose/validate scripts already work this way.
- **Session archive ≠ state.db.** Files under `~/.hermes/sessions/` (`.jsonl` transcripts, `session_*.json` checkpoint dumps) are raw exports that `session_search` never reads — search uses FTS on `state.db`. Before deleting or compressing old session files, verify they overlap with state.db's date range; if so, they're 100% redundant. The default cleanup is `tar.gz` compress (~80% reduction), not `rm`.
- **Dead cron vs stale cron.** A cron job with `last_status: ok` but `last_delivery_error: [99992402]` = **delivery** problem (fixable, clear stale thread_id). A cron job whe
...[truncated 25 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/hermes-audit-procedure.md (reported line 124)May include surrounding context.

Session file cleanup (>14 days old, move not delete):

bash

mkdir -p ~/.hermes/sessions/archive
for f in $(find ~/.hermes/sessions/ -maxdepth 1 \( -name '*.jsonl' -o -name 'session_*.json' -o -name 'request_dump_*.json' \) -mtime +14); do
    mv "$f" ~/.hermes/sessions/archive/
done

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The destructive cleanup section lacks strong user-facing warnings about irreversible deletion, assumptions about redundancy, and the possibility of partial or incorrect archive verification. Without explicit cautions, an agent or operator may treat dangerous commands as routine maintenance and delete data that is still needed for recovery, audit, or troubleshooting.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/hermes-audit-procedure.md (reported line 477)May include surrounding context.

md

## Tools Note

- `execute_code` is blocked in cron sessions — write a standalone Python
  script to `/tmp/` and run it via `terminal` instead.
- Multi-line terminal commands with heredocs or long pipes may get truncated
  by the terminal tool. Use single-line commands or short scripts.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference log documents the audit skill making nontrivial modifications to user workspace content, including adding front matter and moving files, despite the skill being described as a system/workspace audit. That expands the operational scope from diagnosis into mutation, which can cause unintended data changes and creates a mismatch users may not expect from an audit tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document states that moving files to archive is 'safe and reversible' and needs no user approval, which authorizes mutation of user data without confirmation. Even if reversible in principle, such moves can break references, workflows, indexing, or user expectations, especially in a workspace containing semantically organized notes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code emits natural-language content using a fixed Chinese term ('行') in report details, and later also uses Chinese section labels, regardless of user preference or environment. That creates a locale policy issue because the skill forces a specific language in its output without opt-in or any documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report body contains multiple hard-coded Chinese strings such as the success message and priority labels, which means users receive output in a specific language by default. Under the policy, forcing a locale without giving the user a choice or clearly documenting a justified regional scope is a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The verification step requires archived files to appear in search with the [归档] prefix, which imposes a specific language choice in natural-language output. The file does not indicate user opt-in, configurability, or a documented reason for enforcing this locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The checklist includes a fix to add trace_logger.py to record agent task execution, which could affect privacy or user data visibility. In this markdown file, there is no accompanying warning or disclosure about what execution data would be captured or how it would be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code writes JSON output to a user-supplied path via --report, which can create or overwrite a file. Although the operation is part of the tool's purpose, there is no visible runtime disclosure beyond the CLI help text and no confirmation before the write occurs.

Content

No source excerpt is available for this finding.