ClawHub
Back to skill

Security audit

render-on-hermes

Security checks for vulnerabilities and agentic risk

Overview

This Render operations skill is transparent about using powerful Render MCP access, but it gives broad production-changing authority without a clear confirmation gate.

Install only if you want agents in this Hermes environment to use the configured Render MCP server with the full permissions of RENDER_MCP_API_KEY. Before allowing deploys, restarts, service updates, environment-variable changes, resource creation, or database writes, require the agent to name the workspace, target resource, exact change, and wait for explicit confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The invocation condition is very broad: 'use whenever any other render-* skill loads, or any time the user asks you to do something on Render.' That can cause this bootstrap skill to activate for many ordinary Render-related requests and bias the agent toward using preconfigured high-privilege MCP tooling even when the user only wanted guidance or low-risk inspection. In this context, broad activation increases the chance of unnecessary exposure to powerful mutation-capable tools and can bypass more task-specific safety framing from narrower skills.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly says to treat user requests to mutate Render resources as allowed by this setup, while advertising full MCP tool access and listing destructive operations. Although it says to be explicit about the effect before acting, it does not require explicit confirmation before executing mutations, which is risky in an environment with production-affecting capabilities. Given this is an operations skill for a live Render environment, ambiguous or indirect user phrasing could lead to unintended deploys, config changes, restarts, or database actions.

Static analysis

No suspicious patterns detected.