Hermes Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 2.0.0

Overview

This Hermes guide is mostly coherent, but it normalizes direct remote script execution, approval bypass, and long-running full-access agents without enough safety scoping.

Install only if you intend to use Hermes as a powerful local agent. Review the remote installer before running it, avoid yolo or approval-bypass modes unless you are in a controlled environment, and be careful with gateway, cron, memory, credential, and spawned-agent features because they can act across sessions and services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:37

Finding

Mutable Remote Installation Script Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 37
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

Technical Analysis

The Quick Start downloads a shell script from a mutable main branch and sends the response directly to Bash. The command does not pin the payload to an immutable commit, verify a checksum or cryptographic signature, or save the script for inspection before execution.

Although the GitHub organization and repository correspond to the project identified in the Skill metadata, the remote script is not included in the audited artifact. Its effective contents can therefore change after this Skill has been reviewed. Repository compromise, maintainer-account compromise, or unauthorized modification of the upstream script could turn this documented installation command into an arbitrary-code execution channel.

Direct execution is not necessary to achieve the declared installation function. A pinned, independently verified release artifact would provide installation functionality with materially lower supply-chain risk.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or another part of the remote delivery path.
2. The attacker modifies scripts/install.sh on the mutable main branch to include malicious shell commands.
3. A user or agent follows the documented Quick Start command.
4. curl retrieves the modified response without validating its identity or integrity.
5. The shell executes the response immediately, without an opportunity for inspection.
6. The malicious script acts with all privileges available to the invoking account.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The payload coul ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe network responses directly into a shell.

• Publish versioned installation artifacts and pin the documentation to an immutable release tag or commit.

• Provide a SHA-256 checksum or cryptographic signature through an independently protected release process.

• Download the installer to a local file, verify its integrity, and allow users to inspect it before execution.

• Avoid elevated privileges unless a clearly identified installation step requires them.

• Prefer a trusted package manager with signed metadata and reproducible, versioned packages where available.

• Use a safer documented flow similar to:

  bash

  curl -fL -o install.sh "https://raw.githubusercontent.com/NousResearch/hermes-agent/<immutable-commit>/scripts/install.sh"
  echo "<expected-sha256>  install.sh" | sha256sum -c -
  less install.sh
  bash install.sh
  

The immutable commit and expected checksum must be replaced with reviewed, project-published values.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:373

Finding

Unpinned Python Package Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 373
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install faster-whisper

Technical Analysis

The troubleshooting instructions install the latest package version selected by the configured Python package index. No version constraint, lock file, package hash, or isolated virtual environment is specified. The resulting installation is not reproducible and may introduce unexpectedly changed direct or transitive dependencies.

Python package installation can execute package-controlled build logic. Consequently, compromise of the referenced package, one of its dependencies, or the configured package index could result in code execution during installation. Running the command against a shared or global Python environment also risks dependency conflicts and unintended modification of other applications.

Attack Path

1. An attacker compromises the package, one of its transitive dependencies, or a package-index account used in dependency resolution.
2. A malicious or compromised package release becomes the version selected by the unpinned command.
3. A user follows the voice troubleshooting instructions and runs pip install faster-whisper.
4. pip downloads the mutable package set without verifying project-published hashes from a lock file.
5. Malicious build or installation logic executes with the privileges of the invoking user.
6. The payload accesses or modifies resources available to that user or contaminates the shared Python environment.

Impact Assessment

Exploitation could provide arbitrary code execution under the account running pip. Accessible files, environment variables, API credentials, source repositories, and Python environments could be read or modified. If installation occurs in a privileged or system-wide environment, the blast radius may include system Python packag ...[truncated 241 chars]

Remediation

View remediation

Remediation Suggestions

• Specify a reviewed package version rather than installing an unconstrained latest release.

• Install the dependency in a dedicated virtual environment instead of a global or shared Python environment.

• Lock all direct and transitive dependencies using a reproducible dependency-management process.

• Require package hashes during installation, for example through a generated requirements file used with pip install --require-hashes.

• Review release provenance and dependency changes before updating the pinned version.

• Where supported, use signed package provenance and a trusted, explicitly configured package index.

• Document a hardened installation flow, such as:

  bash

  python -m venv .venv
  . .venv/bin/activate
  python -m pip install --require-hashes -r requirements-voice.txt
  

The referenced requirements file should contain reviewed, pinned versions and hashes for every resolved dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping curl output directly into bash is a classic command-chaining anti-pattern because it turns remote content into immediate shell execution. In the context of an agent framework with broad system access, normalizing this pattern increases the blast radius of any upstream compromise or man-in-the-middle event.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash

# Install
curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

# Interactive chat (default)
hermes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

hermes config edit          Open config.yaml in $EDITOR
hermes config set KEY VAL   Set a config value
hermes config path          Print config.yaml path
hermes config env-path      Print .env path
hermes config check         Check for missing/outdated config
hermes config migrate       Update config with new options
hermes login [--provider P] OAuth login (nous, openai-codex)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

hermes config edit          Open config.yaml in $EDITOR
hermes config set KEY VAL   Set a config value
hermes config path          Print config.yaml path
hermes config env-path      Print .env path
hermes config check         Check for missing/outdated config
hermes config migrate       Update config with new options
hermes login [--provider P] OAuth login (nous, openai-codex)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says to load this skill when helping users configure Hermes, troubleshoot issues, spawn agent instances, or make code contributions, which covers a very wide range of common support and development interactions. It does not provide explicit trigger phrases, boundaries, or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation recommends executing a remote install script via curl piped directly to bash without any integrity verification or warning. If the remote source, transport, or repository is compromised, users could execute attacker-controlled code immediately on their system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The global --yolo flag is presented as a normal option without warning that it disables dangerous-command approval safeguards. In an agent with terminal and file tool access, encouraging or normalizing safeguard bypass materially increases the chance of destructive or unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The in-session /yolo command similarly exposes approval bypass without explaining that it turns off dangerous-command safeguards. Because it can be toggled interactively mid-session, it may lead users to disable protections casually during high-risk operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 599)May include surrounding context.

Adding a Tool (3 files)

1. Create tools/your_tool.py:

python

import json, os
from tools.registry import registry

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The installation example fetches and runs an external script directly from a remote URL, creating supply-chain risk. Users are encouraged to execute unaudited code from the network in one step, which reduces opportunities to inspect content or detect tampering.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash

# Install
curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash

# Interactive chat (default)
hermes

Static analysis

No suspicious patterns detected.