hermes-browser-fedora-atomic

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 9:09 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent troubleshooting guide for fixing Hermes local browser automation on Fedora Atomic, with disclosed install and configuration steps.

Before installing, understand that the documented `npx` commands download and run the current `agent-browser` package from npm and install a persistent local Chromium. Prefer a pinned, reviewed package version if your environment requires stronger supply-chain controls, and only use the `sudo rpm-ostree install <lib>` fallback for a specific missing library you have verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs users to run `npx --yes agent-browser` without pinning a specific package version. Because `npx` fetches the latest published package at execution time, a compromised upstream release or dependency confusion event could cause users to execute unreviewed code on their machine.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. Built-in `browser_*` tools now auto-launch / reap this Chromium. Reboot-safe — there is no static port to keep alive.

### Why NOT `--with-deps`
`--with-deps` runs the OS package manager for Chromium's shared libs. On Fedora Atomic that path assumes classic `dnf` and will not use `rpm-ostree` — it fails or behaves wrongly. Skip it: the desktop / flatpak stack already provides the needed libs, so local Chromium launches fine without it. If a missing `.so` appears later, layer just that lib with `sudo rpm-ostree install <lib>` deliberately.

## CRITICAL: browser_exec != built-in browser tools
- **Built-in `browser_*` tools** (navigate / snapshot / click / type / scroll …) ride Hermes's managed local Chromium. This is the working path.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command again relies on an unpinned `npx` package fetch at runtime. Even though it is only used for verification, it still executes package code from the registry and exposes the user to supply-chain risk if the package or its dependencies are malicious or tampered with.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Running `npx --yes agent-browser close` without version pinning has the same supply-chain exposure as the other `npx` invocations. The skill is operational guidance, so users are likely to copy-paste it directly, making the lack of version control materially risky.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The command uses `npx --yes agent-browser` without pinning an exact package version, so execution depends on whatever version is current in the npm registry at runtime. If the package is compromised, a malicious update is published, or a breaking release appears, users could run unreviewed code on their system during install or execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: This invocation runs `agent-browser` via `npx` without an explicit version, which causes users to fetch and execute the latest published package at the time of use. In a security-sensitive agent skill, that creates supply-chain risk because package behavior can change or become malicious independently of the reviewed skill content.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: Using `npx --yes agent-browser close` without a pinned version means a future or compromised npm release could be downloaded and executed when the user follows the instructions. Even though this command appears operationally harmless, `npx` package execution itself is the risky step because arbitrary install scripts or runtime code may run.

Static analysis

No suspicious patterns detected.