Hermes Features for OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it needs Review because it automatically reads past sessions, writes long-term memory and skills, schedules recurring self-review, and retains overflow data indefinitely.

Install only if you intentionally want an agent that can review previous sessions, keep profile and project details, create or update skills, and run recurring self-improvement jobs. Before enabling it, require explicit approval for every memory or skill change, remove the 24-hour auto-apply path, add controls to disable cron/heartbeat review, and define retention and deletion rules for USER.md, MEMORY.md, and overflow archives.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: aquila-hermes-features.md:24

Finding

Automatic Skill Generation Enables Persistent Instruction Poisoning

Content

View full analysis

5.000 → Aufräumen 5. **LOG:** Schreibe Zusammenfassung in `vault/10-journal/YYYY-MM-DD.md` unter `## Self-Review` ### Skill: `auto-skill-builder` - **Zweck:** Erkennt wann ein Workflow als Skill gespeichert werden sollte - **Trigger:** - 5+ Tool-Calls in einer Session - Fehlversuch → erfolgreicher Weg - Nutzer-Korrektur - Wiederkehrende Aufgabe (3x in 30 Tagen) - **Prozess:** 1. Erkennung nach komplexen Tasks 2. Extraktion: Name, Beschreibung, Trigger, Prozedur, Pitfalls, Verifikation 3. Erstellung via `skill_workshop(action=create)` 4. Als pending proposal speichern 5. Nutzer bestätigt mit `skill_workshop(action=apply)` oder nach 24h automatisch ``` ### Technical Analysis The documented learning loop treats content from previous sessions as material from which durable agent instructions may be generated. It can write extracted information to `MEMORY.md`, create new skills, or update existing skills. Session content is not necessarily trustworthy. It may include untrusted documents, prompt-injection tex ...[truncated 1820 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: aquila-hermes-features.md:162

Finding

Recurring Cron and Heartbeat Hooks Establish Cross-Session Persistence

Content

View full analysis

4.000 chars? → Konsolidieren - USER.md >1.100 chars? → Konsolidieren ``` ### Cron + Heartbeat — Zwei Nudge-Mechanismen | Stufe | Mechanismus | Frequenz | Was passiert | |-------|-------------|----------|-------------| | **Cron-Nudge** | `hermes-style-self-review` | Alle 30 Min | Isolierter GPT-5.5 Run: Sessions reviewen → Patterns extrahieren → Skills/Memory erstellen | | **Heartbeat-Nudge** | HEARTBEAT.md Integration | Bei jeder Interaktion mit dir | Inline im Haupt-Session-Kontext: Letzte Sessions checken, Patterns erkennen, MEMORY.md prüfen | ``` ```markdown ### Aktueller Status - ✅ Geschlossene Lernschleife: Cron + Heartbeat-Nudge aktiv - ✅ Skill-System: Auto-Erstellung + Progressive Disclosure - ✅ Persistentes Gedächtnis: 4 Dateien mit Kapazitätslimits + Write-Block + Overflow - ✅ Konsolidierung: Bei >80% automatisch, Details in Overflow - ✅ Keine Datenverluste: Alles wird ausgelagert, niemals gelöscht ``` ### Technical Analysis The skill documents two recurring execution mechanisms: a cron-triggered self-review and a heartbeat hook executed during interactions. These mechanisms continue beyond the initiating task and repeatedly inspect previous sessions ...[truncated 1784 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: aquila-hermes-features.md:199

Finding

Broad Cross-Session Collection and Indefinite Retention of User Data

Content

View full analysis

/` — Projekt-spezifische Details (Switch-Tabellen, API-Docs, etc.) ### Vorteil des Overflow-Systems - **Keine Token-Kosten:** Overflow wird NIE in System-Prompt injiziert - **Keine Datenverluste:** Alles wird ausgelagert, niemals gelöscht - **Aquila lädt bei Bedarf:** `read vault/30-knowledge/MEMORY-overflow.md` — alle Details sofort verfügbar ``` ```markdown ## Session-Suche (FTS5-Äquivalent) OpenClaw bietet `sessions_list` + `sessions_history` als Äquivalent zu Hermes' FTS5-Session-Suche: - `sessions_list(search="keyword")` → Sessions finden - `sessions_history(sessionKey)` → Inhalt lesen - Kein LLM-Call nötig, direkter DB-Zugriff ``` ### Technical Analysis The documented workflow can search for sessions, read complete session contents, extract profile and project information, and retain displaced details in overflow archives. The stated policy that information is always archived and never deleted creates indefinite retention. The documentation excludes secrets from `MEMORY.md`, but it does not establish equivalent enforcement for session analysis or overflow archives. It also lacks consent requirements, purpose limitation, sensitivity classificati ...[truncated 1637 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states that the system automatically creates skills and memory entries from prior sessions, but it does not clearly warn that these actions write persistent data to disk and may retain user or session content beyond the current interaction. In an agent with self-improvement and memory features, this can cause unintentional retention of sensitive prompts, outputs, or derived workflows without informed user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README documents automatic archival of memory and user-profile overflows into persistent vault files, but it does not explicitly warn that potentially sensitive personal, behavioral, or conversational data may be preserved in archives. Archival increases exposure because users may assume truncated memory is discarded, while in reality it is retained in secondary locations that may be overlooked during review, deletion, or access control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly describes automatic creation of skills and memory entries from prior sessions, which means it can write persistent state without a clear user-facing warning or consent boundary. In an agent environment, autonomous persistence can capture sensitive prompts, secrets, or incorrect inferences and make them durable, increasing privacy, integrity, and supply-chain risk over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The overflow design archives data automatically into additional files, but the skill does not clearly warn users that content exceeding limits will still be retained elsewhere. This is dangerous because users or operators may believe truncation or hard limits prevent retention, while in reality sensitive or stale data is silently propagated into archive locations that broaden persistence and exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The learning loop explicitly reviews prior sessions, extracts user corrections and workflows, and writes them into persistent memory and skills. This creates a durable collection and resurfacing channel for potentially sensitive user content, including information users did not expect to be retained long-term, and the self-improvement context makes it more dangerous because retained content can influence future autonomous behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document authorizes automatic application of newly generated skills after 24 hours, which changes the agent's behavior and trusted skill state without an explicit contemporaneous user confirmation. In a self-improving agent, this creates a risky path for prompt-derived, session-derived, or erroneous workflow content to become operational automatically, increasing the chance of persistence of unsafe behavior or privilege expansion.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The USER.md and overflow guidance instructs long-term storage of user attributes, workflow habits, active projects, and related details in plain-language files. Even though it excludes secrets, this still creates a concentrated repository of personal and project metadata that can be exposed, over-retained, or repurposed beyond user expectations, especially because overflow archives are designed to preserve everything indefinitely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The entire natural-language skill document is presented in German, while no user opt-in, language selection, or region-specific justification is provided. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.