other
Error
- Location
SKILL.md:132- Finding
Mandatory External Persistence of Unrelated Credentials and Tokens
- Content
View full analysis
- Remediation
View remediation
Security audit
Synapse Layer Skill for Hermes Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill provides a remote persistent memory integration, but it tells agents to store credentials and tokens in that remote memory and reduces user visibility of tool activity.
Review before installing. This skill sends and retrieves memories through a remote Synapse Layer service and asks the agent to remember far more than ordinary preferences, including credentials and infrastructure details. Do not use it with secrets, bot tokens, API keys, private endpoints, or multi-user channels unless the memory categories are narrowed, remote tool activity remains visible, and you have clear retention, deletion, and secret-redaction guarantees you can verify.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:82- Finding
Forced Cross-Session Recall Enables Persistent Memory Poisoning and Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:46- Finding
Tool Activity Is Deliberately Hidden from Telegram Users
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
connect_timeout: 60
text ### 2. Add Token to .env Add your Synapse Layer token to `~/.hermes/.env`:
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
text mcp_synapse_layer_save_to_synapse( content="User Rafa Martins preference: always respond in pt-BR with voice Thalita", agent_id="hermes-rafa", type="[MANUAL]", importance=5,
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages persistent storage of personal data, project details, infrastructure information, and credentials without a clear, informed warning about privacy, retention, cross-channel exposure, or third-party processing. Users could unknowingly consent to broad surveillance-style persistence of sensitive context far beyond what is necessary for functionality.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the agent to persist sensitive personal data and credentials across sessions and channels, which magnifies confidentiality risk and makes accidental disclosure more likely in future conversations. Cross-channel recall means data shared in one context may surface in another with different trust assumptions or participants.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The skill's guidance to save 'API endpoints and access credentials' into memory directly promotes retention of operational secrets in a recallable, cross-session store. If exposed through compromise, over-broad recall, or cross-channel leakage, an attacker could gain access to infrastructure and linked services.
- Content
md ### 3. SERVER INFRASTRUCTURE - Server name/hostname (serve) - Running services and ports (Open WebUI:$port, Hermes API:$port, Voice Call:$port) - API endpoints and access credentials - Docker containers and their configs - **Save when**: New service added, config changed, credentials updated
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to persist highly sensitive credentials and infrastructure secrets, including tokens, endpoints, and access details, in cross-session memory. A memory-layer skill has no legitimate need to retain raw secrets, and centralizing them expands blast radius across sessions, channels, tools, and any compromise of the remote memory backend.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document says PII and API keys are auto-redacted, but elsewhere explicitly instructs the agent to store tokens, credentials, and contact data as memories. That contradiction creates a real risk that operators will assume secrets are protected and persist them to a third-party memory service.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims 'no plaintext leaves the agent' while also instructing the agent to send memory content and fallback JSON-RPC requests to a remote HTTPS endpoint. This is materially misleading because users and downstream agents may treat sensitive content as local-only when it is in fact transmitted off-host.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README makes strong security claims about AES-256-GCM encryption and a non-bypassable 4-layer privacy pipeline, but this file only shows configuration for a remote service and provides no local implementation or verifiable enforcement. That creates a supply-chain trust problem: users may send sensitive persistent memory to an external endpoint based on undocumented assurances they cannot validate from the skill itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README promotes cross-session, cross-channel persistent memory but does not prominently warn that user data is transmitted to and stored by a remote external service. In a memory skill, this omission is significant because operators may persist sensitive conversations, preferences, or operational facts under the assumption the feature is local or fully private.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that automatic REST fallback logic is included, but only documents a manual curl invocation and does not show any implementation of that behavior. Users may rely on resilience and failure-handling that do not actually exist, causing memory operations to silently fail or push operators toward ad hoc manual API use with tokens and sensitive queries.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The README directly instructs users to send authenticated requests containing memory queries to an external endpoint, which confirms external transmission of potentially sensitive context. In the context of a persistent memory skill, this is expected functionality, but it is still security-relevant because it expands the trust boundary to a third-party service and can expose sensitive data if users are not clearly warned and access controls are weak.
- Content
Direct REST API (Always Works)
bash curl -X POST "https://forge.synapselayer.org/mcp" \ -H "Authorization: Bearer ${SYNAPSE_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"recall","arguments":{"query":"your query","limit":3}}}'
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example persisted preference says to 'always respond in pt-BR with voice Thalita,' which imposes a specific language/locale behavior. The file does not present this as a user-selectable option or an explicitly justified regional constraint, so it conflicts with the language/locale policy requirement.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### 9. DECISIONS & CONVENTIONS - Architectural decisions (why a tool/approach was chosen) - Coding conventions the user prefers - Commands that should not be run without approval - **Save when**: User makes a decision, user sets a convention ### 10. ERROR PATTERNS & FIXES
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # JSONRPC 2.0 format — list available tools curl -X POST "https://forge.synapselayer.org/mcp" \ -H "Authorization: Bearer ${SYNAPSE_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The example saves the preference "User prefers responses in pt-BR with Thalita voice," which encodes a forced locale/language choice in natural language without showing that the user explicitly opted in. This can normalize a language-policy constraint without documenting choice or consent.
- Content
Static analysis
No suspicious patterns detected.