Agent Roundtable

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.2.4

Overview

This skill matches its roundtable-discussion purpose, but its web viewer and export features create review-worthy exposure through broad file writes, a persistent network service, and viewer-side security flaws.

Install only if you trust the publisher and are comfortable with local discussion data being stored and, when web mode is enabled, served by a PM2-managed Node process. Use web mode only on trusted machines/networks, prefer loopback-only binding, manually clean up PM2 processes, avoid untrusted participant metadata, and do not supply output_path values outside an intended project output directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/roundtable/web/viewer.js:419

Finding

Stored Cross-Site Scripting Through Unsanitized Participant Metadata

Content

View full analysis

{ const agent = p.profile || p.participant || ''; const avatar = getParticipantAvatar(agent); const name = escapeHtml(p.display_name || p.profile || '?'); const roleType = getRoleType(p.role || ''); const speechCount = state.speeches ? state.speeches.filter(s => s.participant === agent).length : 0; return `

${avatar} ``` The streaming speech renderer contains a similar sink: ```javascript const avatar = getParticipantAvatar(agent); const speakerName = escapeHtml(meta.name); const safeRoleName = escapeHtml(meta.role); const round = roundNum > 0 ? `R${roundNum}` : ''; const roleTagClass = getRoleTagClass(meta.roleType); div.innerHTML = `

${avatar}

``` ### Technical Analysis Participant metadata is supplied by the caller during discussion creation and is copied into the web viewer's discussion data. The viewer obtains the participant avatar through `getParticipantAvatar()` and inserts it directly into an `innerHTML` template without HTML sanitization or contextual output encoding. The `renderMarkdown()` function uses DOMPurify when a ...[truncated 2029 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/roundtable/core.py:998

Finding

Arbitrary File Overwrite Through Unrestricted Output Path

Content

View full analysis

dict[str, Any]: """Write generated Markdown to the configured discussion output path.""" try: path = Path(output_path).expanduser() path.parent.mkdir(parents=True, exist_ok=True) path.write_text(content.rstrip() + "\n", encoding="utf-8") return {"output_written": True, "output_path": str(path)} except Exception as exc: logger.exception("Failed to write roundtable output_path: %s", output_path) return {"output_written": False, "output_path": output_path, "output_error": str(exc)} ``` ### Technical Analysis The `output_path` parameter is exposed through the public discussion initialization interface. When a discussion is summarized or concluded, `_write_markdown_output()` expands the supplied path, creates missing parent directories, and writes to the destination. The implementation does not: - Restrict writes to the active workspace or a dedicated output directory. - Resolve the canonical path and verify it remains under an allowed root. - Reject symbolic links. - Reject existing files. - Require user confirmation before overwriting a file. - Restrict the destination to regular Markdown files. Therefore, any path writable by the Agent process can be replaced with generated discussion content. The content is partly influenced by discussion participants, making this both an arbitrary-path write and an attacker-influenced content-write primitive. ### Attack Path 1. An attacker uses prompt injection or control over a tool invocation to set `output_path` to a sensitive writable location. 2. Example targets could include an application configuration file, shell initialization file, project automation file, or another ...[truncated 1186 chars]

Remediation

View remediation

/docs/roundtable`, and require every output to remain beneath it. 2. Resolve both the output root and requested destination canonically: ```python root = allowed_root.resolve(strict=True) destination = (root / requested_name).resolve(strict=False) if destination != root and root not in destination.parents: raise ValueError("output_path is outside the allowed output directory") ``` 3. Accept a relative filename instead of an unrestricted absolute path. 4. Reject symlink components using `lstat()` or open the destination with platform-appropriate no-follow protections. 5. Reject non-regular files. 6. Use exclusive creation by default and require explicit user confirmation before replacing an existing file. 7. Restrict output extensions to expected document formats such as `.md`. 8. Do not create arbitrary parent directories outside the approved output root. 9. Log the canonical destination and surface it to the user before writing. 10. Add tests covering absolute paths, `..` traversal, home expansion, symlinks, and attempts to overwrite existing files. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/roundtable/web/server.mjs:327

Finding

Shared Viewer Token Grants Unauthorized Link Revocation

Content

View full analysis

{ if (!isTokenValid(params.token)) return send403(res); // Mark as revoked const data = readDiscussion(); if (!data) return sendJSON(res, { error: "Discussion not found" }, 404); if (!data.revoked_tokens) data.revoked_tokens = []; if (!data.revoked_tokens.includes(params.token)) { data.revoked_tokens.push(params.token); } data.updated_at = Math.floor(Date.now() / 1000); // Write back const tmpPath = DISCUSSION_PATH + ".tmp"; writeFileSync(tmpPath, JSON.stringify(data, null, 2)); renameSync(tmpPath, DISCUSSION_PATH); // Notify all clients broadcastToSSE(params.token, "revoked", { revoked: true }); sendJSON(res, { ok: true, revoked: true }); }); ``` ### Technical Analysis The URL token serves as the bearer credential for viewing, polling, replaying, sharing, and revoking a discussion. A user who receives a share URL necessarily receives this token. The revocation endpoint verifies only that the viewer token is currently valid. It does not verify that the requester is the discussion creator or administrator. There is no separate management credential, authenticated owner session, role check, Origin validation, or CSRF defense. This collapses read and administrative privileges into the same bearer secret. As a result, every viewer is implicitly authorized to perform a destructive management operation. ### Attack Path 1. The discussion creator shares a normal viewer URL with another participant. 2. The recipient extracts the token from `/r/`. 3. The recipient sends: ```http POST /api//revoke HTTP/1.1 Host: viewer-host:8199 ``` 4. The server va ...[truncated 811 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: src/roundtable/web/server.mjs:780

Finding

PM2-Managed Discussion Viewer Persists and Listens on All Network Interfaces

Content

View full analysis

{ console.log(`[Roundtable Web] Listening on http://0.0.0.0:${port}`); startFileWatcher(); }); ``` ```javascript server.listen(port, "0.0.0.0", () => { console.log(`[Roundtable Web] Listening on http://0.0.0.0:${port} (builtin)`); startFileWatcher(); }); ``` Normal conclusion deliberately retains the service: ```python # Web publisher hook. A concluded viewer remains online for post-meeting # review; force-cancel still stops it immediately. publisher = self._publishers.get(discussion_id) web_retained = False if publisher: try: if action == "concluded" and disc_after: findings = self.db.get_findings(conn, discussion_id) all_points = [f.content for f in findings] publisher.on_final_summary( consensus=[{"content": p} for p in all_points], disagreement=[], verdict=disc_after.conclusion or "", ) publisher.conclude(disc_after.conclusion or "") web_retained = True logger.info("Web publisher retained for concluded discussion %s", discussion_id) else: self._publishers.pop(discussion_id, None) publisher.stop() ``` Cleanup depends on explicitly deleting the PM2 process: ```python def stop(self) -> None: """PM2 stops the Express process.""" if self._pm2_process_name: try: result = subprocess.run( ["pm2", "delete", self._pm2_process_name], capture_output=True, text=T ...[truncated 2480 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (187)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Web publishing/viewer management via Node/PM2, file I/O, network port usage, subprocess lifecycle, and access tokens substantially enlarge the risk surface. If compromised or misconfigured, these features could expose transcripts, leak tokens, or leave accessible local services running beyond the intended session.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

free of private team data, include both Hermes and OpenClaw metadata blocks in `SKILL.md`, check `hermes skills publish --help`, `clawhub publish --help`, and `

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

md

er must be force-refreshed to see updates. **Root cause**: The Express server (`server.mjs`) uses `fs.watch(DISCUSSION_PATH, ...)` to detect `discussion.json` c

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs environment bootstrapping and shell-based installation into a Hermes venv, including direct package installation paths. Normalizing shell and environment manipulation inside a skill increases the chance of unsafe command execution, persistence, and supply-chain exposure beyond the core purpose of facilitating discussion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The emergency and hybrid workflows explicitly direct shell execution and inline Python heredocs to mutate discussion state outside the normal tool boundary. This bypasses permission controls, increases injection risk through interpolated content, and undermines the security model of using constrained tools instead of arbitrary code execution.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/product/english-adaptation-prd.md (reported line 152)May include surrounding context.

Line 181:

html

<!-- Current -->
<div class="tagline">让多个 AI Agent 坐下来开会讨论<br>自动追踪共识与分歧，得出结论</div>

<!-- Target -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/product/english-adaptation-prd.md (reported line 152)May include surrounding context.

Line 181:

html

<!-- Current -->
<div class="tagline">让多个 AI Agent 坐下来开会讨论<br>自动追踪共识与分歧,得出结论</div>

<!-- Target -->

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The design adds subprocess-based PM2 process management, allowing the skill path to launch and manage external Node.js services. Even though the shown subprocess invocation avoids shell injection, this is still a privileged capability expansion that can persist background services, broaden execution surface, and create operational/security risks not inherent to a discussion skill.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/release/release.sh (reported line 192)May include surrounding context.

sh

cd "$SKILL_TMPDIR"
    git add SKILL.md
    git -c user.name="agent-xiaohe" -c user.email="[e-mail]" \
      commit -m "chore: update SKILL.md to v$NEW_VERSION" 2>/dev/null || echo "  No changes to commit"
    git push origin main 2>&1 && ok "Synced SKILL.md to $HERMES_SKILL_REPO" || warn "Push to pointer repo failed"
    cd "$ROOT_DIR"
    rm -rf "$SKILL_TMPDIR"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/release/release.sh (reported line 218)May include surrounding context.

sh

--title "v$NEW_VERSION" \
      --notes-file "/tmp/release-notes-$NEW_VERSION.md" \
      2>&1 && ok "GitHub Release created" || warn "GitHub Release failed"
    rm -f "/tmp/release-notes-$NEW_VERSION.md"
  else
    gh release create "v$NEW_VERSION" \
      --title "v$NEW_VERSION" \