Hermes Learning Loop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.0

Overview

This skill is not deceptive, but it creates persistent agent memories and skills from session content with weak review and sanitization controls.

Install only if you intentionally want an agent to maintain persistent learning files. Keep automatic creation disabled, run it manually, review generated SKILL.md and memory files before reuse, avoid untrusted session JSON, and point its memory/skills directories at an isolated location you can inspect and delete.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/learning-loop.js:220

Finding

Untrusted Session Content Can Poison Persistent Agent Skills

Content

View full analysis

`tool-${i}`), steps: [ { title: 'Step 1', command: 'command1' }, { title: 'Step 2', command: 'command2' } ], summary: 'Simulated complex task', errorRecovery: true, errorType: 'TestError', complexity: 8 } } } ``` Attacker-controlled fields are copied into a persistent skill object: ```js async function extractWorkflowSkill(task) { // Extract reusable workflow from task const skill = { name: generateSkillName(task), description: task.summary || 'Automated workflow', version: '1.0.0', platforms: ['linux', 'macos'], steps: task.steps || [], toolCalls: task.toolCalls || [], metadata: { tags: extractTags(task), category: detectCategory(task), createdFrom: task.id } } return { skill } } ``` Those fields are interpolated into YAML and Markdown without safe serialization or instruction filtering: ```js async function createSkill(skill) { const skillDir = join(SKILLS_DIR, skill.metadata.category || 'misc', skill.name) await mkdir(skillDir, { recursive: true }) const skillContent = generateSkillMarkdown(skill) await writeFile(join(skillDir, 'SKILL.md'), skillContent) console.log(`\n📄 Created: ${join(skillDir, 'SKIL ...[truncated 3723 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly promotes automatic extraction, creation, and persistence of skills and curated memories across sessions, but it does not prominently warn that this behavior writes agent-generated content into user data locations such as skill directories or memory files. In an agent setting, silent persistence can store sensitive prompts, workflows, or user-derived data without informed consent, increasing privacy and integrity risk even if the feature is intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The documented triggers for automatically creating skills from session activity imply long-lived persistence of behavioral and task-derived data based on heuristics, including user corrections and multi-step workflows. This can capture sensitive operational knowledge or user-specific context and convert it into durable artifacts without a clearly described sanitization, approval, or retention boundary.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

md

## 📋 Skill Triggers

Automatically create skill when:
- ✅ 5+ tool calls in sequence
- ✅ Recovered from error successfully
- ✅ User corrected → fixed approach

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

interval: 5

skill_creation: auto_approve: false min_tool_calls: 5

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of environment-driven execution and automation (export SESSION_ID, other env vars) but does not declare any explicit tool scope such as permissions or allowed tools. In a self-modifying, persistence-oriented skill, missing scope boundaries increases the chance the agent can read sensitive environment data or perform broader actions than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description presents the skill as a helpful self-improvement feature but does not clearly warn that it persists task history, user preferences, and generated skills across sessions. That omission can cause users to enable the skill without informed consent to long-term storage and reuse of potentially sensitive data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill explicitly supports extraction, creation, and periodic nudging that persist knowledge across sessions, which is a real session-persistence risk. In context, this is the core feature rather than a hidden backdoor, but it is still dangerous because it can save sensitive operational history, user preferences, or confidential workflow details into long-lived storage.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

# After completing a task
node learning-loop.js extract --session=<session_id>

# Create skill from workflow
node learning-loop.js create-skill --name="my-skill" --description="What it does"

# Periodic nudge (heartbeat)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section explicitly describes writing to MEMORY.md, USER.md, session archives, and skill files, yet it does not pair that behavior with a strong user-facing warning or mandatory review gate. Because the stored content may include workflows, corrections, and contextual history, the skill can inadvertently retain secrets, proprietary information, or personal data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Automatic skill creation based on heuristics like repeated tool calls, error recovery, or user corrections means session content is being transformed into durable artifacts without guaranteed user review. That makes accidental retention and propagation of sensitive, context-specific, or unsafe procedures more likely, especially because generated skills may later be reused out of context.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

### Skill Triggers

Automatically create skill when:
- ✅ 5+ tool calls in sequence
- ✅ Recovered from error successfully
- ✅ User corrected → fixed approach

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Although the current example sets auto_approve: false, the documented feature supports autonomous approval of skill creation. In a system that writes reusable instructions and memories, autonomous decision-making can institutionalize unsafe workflows, persist bad data, or create artifacts from sensitive session content without a human check.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

interval: 5  # tasks
    
  skill_creation:
    auto_approve: false  # Review before creating
    min_tool_calls: 5
    categories:
      - devops

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The header and manifest describe an automatic self-improving loop that extracts successful workflows and persists knowledge across sessions, but key inputs are mocked: getRecentTasks explicitly uses simulated tasks at L412-L421, loadSession falls back to a fabricated session at L431-L444, and analyzeSessionForCuration returns hard-coded items at L471-L477. As written, the core learning behavior is not actually operating on real session history in many paths.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

extractFeedbackMemory automatically stores task.correction into persistent memory without sanitization or sensitivity review. User corrections can include secrets, proprietary details, or adversarial instructions, so automatically retaining them creates both privacy leakage and memory-poisoning risk for future sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The decision framework printed to the user states 'Successful workflows → Extract as skill' at L348, but decidePersistence marks workflow items as persist:true with type:'skill', and curateMemories then sends persisted items to persistMemory rather than skill creation. This is an active contradiction between the documented behavior and what the code actually does during curation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly directs that user preferences and corrections be persisted, but there is no consent, minimization, or sensitivity check before storing them. In a learning-agent setting, these fields can contain personal, confidential, or security-relevant information, so silent persistence increases privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language guidance operationalizes a behavior of persisting user preferences and feedback, which is risky in an autonomous skill because such content is semantically unbounded. The danger is context-dependent here: a self-improving memory system makes this more concerning because retained text may shape future agent decisions and preserve sensitive information across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

persistMemory appends session-derived content directly to disk with no confirmation at the write point and no content screening. Because this is fed by analyzed session content, an attacker or normal user could cause durable storage of sensitive prompts, credentials, or manipulative text that later influences agent behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Persisted entries are appended verbatim without semantic sensitivity screening, allowing arbitrary session text to become durable memory. In a self-improving agent, this is especially dangerous because it enables long-lived memory poisoning, retention of secrets, and future prompt contamination when those files are later consumed as context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

loadSession accepts a caller-supplied path when the argument ends with .json, then reads that file without restricting it to an approved directory. In an agent context, this broad file-read capability can be abused to ingest unintended local files from elsewhere on disk, potentially exposing sensitive data or feeding attacker-controlled content into downstream persistence and skill-generation flows.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:80