zed-hermes-acp

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill for connecting Hermes to Zed, with sensitive agent permissions disclosed rather than hidden.

Install only if you trust Hermes and want it available inside Zed. Keep tool permissions on confirm or narrowly scoped allow rules, avoid global auto-approve for an unsandboxed External Agent, review changes to Zed settings before saving, and remember Hermes uses its own credentials, tools, MCP configuration, and provider data policies rather than Zed's native agent controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- To block model invocation entirely: `disable-model-invocation: true` in the skill's `SKILL.md`. `(tool-permissions.md)`

### 2.2 Rule precedence (highest -> lowest)
1. **Built-in security rules** — hardcoded, non-overridable (terminal only; e.g. `rm -rf /`, `rm -rf ~`, `rm -rf $HOME`, `rm -rf .`, `rm -rf ..`, any flag combo, case-insensitive, checked per sub-command). `(tool-permissions.md)`
2. `always_deny` — blocks immediately, top priority.
3. `always_confirm` — prompts even when global `default: "allow"`.
4. `always_allow` — auto-approves (unless deny/confirm also match).

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- To block model invocation entirely: `disable-model-invocation: true` in the skill's `SKILL.md`. `(tool-permissions.md)`

### 2.2 Rule precedence (highest -> lowest)
1. **Built-in security rules** — hardcoded, non-overridable (terminal only; e.g. `rm -rf /`, `rm -rf ~`, `rm -rf $HOME`, `rm -rf .`, `rm -rf ..`, any flag combo, case-insensitive, checked per sub-command). `(tool-permissions.md)`
2. `always_deny` — blocks immediately, top priority.
3. `always_confirm` — prompts even when global `default: "allow"`.
4. `always_allow` — auto-approves (unless deny/confirm also match).

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- To block model invocation entirely: `disable-model-invocation: true` in the skill's `SKILL.md`. `(tool-permissions.md)`

### 2.2 Rule precedence (highest -> lowest)
1. **Built-in security rules** — hardcoded, non-overridable (terminal only; e.g. `rm -rf /`, `rm -rf ~`, `rm -rf $HOME`, `rm -rf .`, `rm -rf ..`, any flag combo, case-insensitive, checked per sub-command). `(tool-permissions.md)`
2. `always_deny` — blocks immediately, top priority.
3. `always_confirm` — prompts even when global `default: "allow"`.
4. `always_allow` — auto-approves (unless deny/confirm also match).

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- To block model invocation entirely: `disable-model-invocation: true` in the skill's `SKILL.md`. `(tool-permissions.md)`

### 2.2 Rule precedence (highest -> lowest)
1. **Built-in security rules** — hardcoded, non-overridable (terminal only; e.g. `rm -rf /`, `rm -rf ~`, `rm -rf $HOME`, `rm -rf .`, `rm -rf ..`, any flag combo, case-insensitive, checked per sub-command). `(tool-permissions.md)`
2. `always_deny` — blocks immediately, top priority.
3. `always_confirm` — prompts even when global `default: "allow"`.
4. `always_allow` — auto-approves (unless deny/confirm also match).

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

`~/.var/app/dev.zed.Zed/config/zed/settings.json` (unless a custom
  `XDG_CONFIG_HOME`). Not the macOS/Windows paths.
- **Zed settings.json is JSONC** (Flatpak and native) — Hermes's `write_file`/
  `patch` tools do strict-JSON validation and **refuse to write it** (the `//`
  comments fail the check). Edit with a tolerant method (python anchor-replace;
  see `references/zed-flatpak-setup.md`). Never use a JSON-only writer that
  would strip Zed's comments.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **Layout**: title-bar menu *Panel Layout > Agentic* (or `workspace: use agentic layout`); restore with *Classic*.
- **Switch threads**: click in sidebar, or `ctrl-tab` / `Shift+ctrl-tab` to cycle recent threads (works from Agent Panel too).
- **Thread History**: `ctrl-g` or clock icon. Archive (hover archive icon / `Shift+Backspace`), restore, or permanently delete (trash — unrecoverable). Fuzzy search on titles.
- **Multiple projects**: *Add Project* button (open-folder icon) in bottom bar → recent / Add Local Folders / Add Remote Folder. Multi-root folder projects let one thread read/write across folders.
- **New thread in a project**: hover project header `+`, or `agents sidebar: new thread in group`.
- **Thread types**: Zed Agent thread (Zed settings/profiles/tools/MCP) · External Agent thread (**ACP + Hermes native config**) · Terminal Thread (CLI owns auth).
- **Worktree isolation**: start a thread in a new Git worktree for isolated checkout; detached HEAD by default. Moving a finished thread to history saves/restores its worktree.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This markdown file includes `zed --uninstall`, described as removing Zed and all related files, but provides no warning about data loss, scope of removal, or the irreversible nature of the action. Under the markdown-specific warning criteria, destructive behavior that could affect system integrity should be accompanied by an explicit caution.

Session Persistence

Medium

• Category: Rogue Agent

Content

## settings.json is JSONC
Zed's settings file is JSONC: `//` line comments + trailing commas. Hermes's
`write_file`/`patch` tools run **strict JSON validation** and will **REFUSE**
to write it (`JSONDecodeError` on the comments). Workarounds:
- Edit with a tolerant method on the host (the file is a normal file at
  `~/.var/app/.../settings.json`) — anchor-replace preserves structure:
  ```python

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Built-in security rules** — hardcoded, non-overridable (terminal only; e.g. `rm -rf /`, `rm -rf ~`, `rm -rf $HOME`, `rm -rf .`, `rm -rf ..`, any flag combo, case-insensitive, checked per sub-command). `(tool-permissions.md)`
2. `always_deny` — blocks immediately, top priority.
3. `always_confirm` — prompts even when global `default: "allow"`.
4. `always_allow` — auto-approves (unless deny/confirm also match).
5. Tool-specific `default` (e.g. `tools.terminal.default`).
6. Global `default` (`tool_permissions.default`; `"confirm"` is the default). `(tool-permissions.md)`

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## 5. Quick config shapes (Linux, External Agent context)
- **Hermes-relevant**: tool_permissions still gate Hermes; tune `tools.terminal`/`edit_file`/`write_file`/`delete_path`/`fetch` rules. Sandboxing does not wrap Hermes.
- Global auto-approve (most tools, except deny/confirm/built-ins/settings dirs):
  ```json
  { "agent": { "tool_permissions": { "default": "allow" } } }
  ```

• Confidence: 86% confidence
• Finding: The document explicitly recommends a global configuration with `tool_permissions.default: "allow"` for an external agent that is not OS-sandboxed. In this skill context, that materially lowers user confirmation barriers for terminal, file-write, delete, fetch, and other sensitive actions, increasing the chance that prompt injection or agent mistakes lead to harmful autonomous execution.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

{ "agent": { "tool_permissions": { "default": "allow" } } }
  ```
- Protect sensitive files via `edit_file`/`write_file` `always_deny` patterns (`.env`, `secrets?/`, `\.(pem|key)$`). `(tool-permissions.md)`
- Enable Linux sandbox for **Zed Agent** (not Hermes): install non-setuid `bwrap` (`sudo apt install bubblewrap` + AppArmor profile on Ubuntu). `(sandboxing.md#installing-bubblewrap)`

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file directs the user to modify `settings.json` / JSONC under `agent_servers`, which is a user-data-affecting operation. While the procedure explains how to make the edit, it does not include a direct caution to back up the file or note that malformed JSON/JSONC could disrupt Zed's configuration.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file provides a concrete file-edit recipe, including Python that overwrites `~/.var/app/dev.zed.Zed/config/zed/settings.json`, but it does not warn that the operation changes user configuration and may remove comments or alter existing settings. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that can affect user data or system integrity.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The manifest description implies a narrow integration role: connecting Hermes Agent to Zed using the Agent Client Protocol. The documentation additionally highlights that Hermes can read projects outside the home directory due to a broader runtime grant, which goes beyond the minimal behavior implied by the skill description.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: The stated purpose is to connect Hermes Agent to Zed, for which documenting access to arbitrary paths like /mnt or /srv is not obviously necessary. Calling out that Hermes can read those locations introduces a capability not justified by the manifest's narrowly scoped integration description.

Static analysis

No suspicious patterns detected.