Friends to the End

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for Hermes multi-agent handoffs, but it gives overbroad profile-cloning and service-inspection guidance that can expose or duplicate secrets.

Review this before installing if you use Hermes profiles with real credentials. Prefer clean, least-privilege profiles instead of `--clone-all`, require explicit confirmation before agent handoffs or service restarts, and avoid printing full service environments where secrets may appear.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57

Finding

Broad Profile Cloning Can Unnecessarily Duplicate Credentials and Privileges

Content

View full analysis

--clone-from --clone-all` - Switch the app/service to explicit env vars: `APP_HERMES_PROFILE=` `APP_HERMES_HOME=/root/.hermes/profiles/` - Keep secrets in the Hermes profile, not in app code. ``` The same unsafe cloning pattern is repeated at lines 112-115: ```markdown For embedded apps, avoid long-term dependency on a personal profile name if the app is its own agent. Create a dedicated profile: ```bash hermes profile create pokemon --clone-from chucky --clone-all ``` ``` ### Technical Analysis The Skill recommends creating an application-specific profile by using `--clone-all`. It also states that secrets should be retained in Hermes profiles. Taken together, these instructions may cause all profile contents—including unrelated credentials, tool access, configuration, and state—to be copied from a personal or general-purpose profile into a less trusted application or child-agent profile. A dedicated profile is not an effective least-privilege boundary if it inherits every secret and capability from its source. The new profile may only require one API credential and a small set of tools, but unrestricted cloning can grant access equivalent to the source profile. The issue does not demonstrate an intentional privilege-escalation mechanism in the package itself. It is an insecure configuration recommendation that can expand the consequences of a later compromise. ### Attack Path 1. An operator follows the Skill and clones a personal or broadly privileged profile with `--clone-all`. 2. The resulting profile is ...[truncated 938 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:129

Finding

Unfiltered Systemd Environment Inspection May Expose Service Secrets

Content

View full analysis

systemctl show -p Environment --no-pager ``` ``` Related guidance at lines 52-55 also instructs the agent to inspect the service environment: ```markdown 2. Verify live state. - List profiles: `hermes profile list`. - Check toolsets: `hermes tools list --profile `. - Check skill files or skill list. - Check service env if an app launches Hermes. ``` ### Technical Analysis The command `systemctl show -p Environment --no-pager` prints the complete `Environment` property for the selected service. If credentials are stored as systemd environment variables, the output may include API keys, access tokens, passwords, connection strings, or sensitive internal endpoint information. Running this command through an AI agent can propagate the output into model context, terminal history, execution logs, transcripts, or subsequent agent handoffs. This conflicts with the Skill's own instruction not to print or copy secret values. Although reading systemd service metadata normally requires preexisting local access, the recommendation unnecessarily converts stored service configuration into broadly visible textual output. ### Attack Path 1. A target systemd service contains credentials or tokens in its `Environment` configuration. 2. An operator or agent follows the Skill's verification procedure. 3. The agent runs `systemctl show -p Environment --no-pager`. 4. Systemd returns the complete environment property, including sensitive values where present. 5. The output is captured in an agent transcript, command log, terminal buffer, or shared handoff context. 6. A user or process with access to that output o ...[truncated 578 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrase "wanna play" is common conversational language and can cause accidental invocation in unrelated chats. In a multi-agent handoff skill, unintended activation may lead to unnecessary context sharing, tool use, or agent-to-agent actions the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Allowing invocation from named-agent mentions and "similar" phrases creates fuzzy activation boundaries that are easy to trigger accidentally or through prompt injection-style phrasing. Because this skill coordinates other profiles and services, ambiguous routing increases the chance of unauthorized handoffs, excess privilege use, or disclosure of context to the wrong agent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

3. Trusting filenames.
   - For images/cards/documents, filenames are user-supplied hints at best. Use image/OCR/source matching.

4. Claiming a friend succeeded without verification.
   - Hermes child runs and spawned profiles can fail silently, timeout, or return plausible wrong answers. Verify externally.

5. Leaking secrets between friends.

Static analysis

No suspicious patterns detected.