ClawHub
Back to skill

Security audit

nous-model-deal-router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clear helper for choosing a Nous model and only changes settings after approval, with some install and command-use cautions.

Before installing, prefer a ClawHub-reviewed version, pinned commit, or checksum-verified copy instead of the README's mutable main-branch URL. When using it, expect it to check live Nous Portal information and only let it change your default model after you explicitly approve the exact model.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:16
Finding
Mutable Remote Skill Installation Without Integrity Pinning## Vulnerability Details **File Location**: `README.md`, line 16 **Vulnerability Type**: Mutable remote payload retrieval **Risk Level**: Medium **Code Snippet**: ```markdown ## Install ```bash hermes skills install https://raw.githubusercontent.com/sknewcomb/nous-model-deal-router/main/SKILL.md ``` ``` ### Technical Analysis The documented installation command retrieves the Skill directly from the mutable `main` branch of a GitHub repository. It does not pin the downloaded content to a reviewed commit hash or immutable release, and it provides no checksum or signature verification. Because a Skill contains instructions trusted by the Agent, modification or compromise of the upstream repository could cause users to install content different from the version covered by this audit. The effective payload can therefore change after review without any corresponding change to the documented installation command. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or another process authorized to modify the `main` branch. 2. The attacker replaces `SKILL.md` with instructions that manipulate Agent behavior or induce unsafe tool operations. 3. A user follows the installation command in `README.md`. 4. Hermes downloads the current unpinned version from the compromised branch. 5. The altered Skill is installed and subsequently trusted as Agent instructions. ### Impact Assessment Successful exploitation could modify the instructions executed by Hermes under the user's existing Agent and tool permissions. The resulting scope would depend on the tools and local permissions available to the Agent. Potential effects could include unauthorized command execution, configuration changes, or access to information available in the Agent's execution environment. This issue does not independently grant elevated operating-system privileges; it exposes the privileges already available to the Ag ...[truncated 40 chars]
Remediation
## Remediation Suggestions - Pin the installation URL to a reviewed Git commit SHA rather than the mutable `main` branch. - Prefer an immutable, signed release artifact with documented provenance. - Publish a SHA-256 checksum for each reviewed release and require users or the installer to verify it before activation. - If Hermes supports signature verification, sign the Skill and reject unsigned or invalid updates. - Document a manual inspection step before enabling newly downloaded or updated Skill instructions. - Treat updates as new artifacts requiring security review rather than automatically trusting the latest branch contents.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:107
Finding
Unsafe Shell Command Template for User-Controlled Chat Requests## Vulnerability Details **File Location**: `SKILL.md`, line 107 **Vulnerability Type**: Potential shell command injection **Risk Level**: Low **Code Snippet**: ```markdown ### One-off invocation After approval, use an explicit override without changing the user's default: ```bash hermes chat --provider nous --model <approved-provider/model> -q "<request>" ``` ``` ### Technical Analysis The one-off invocation template places the model identifier and request text into a shell command. The request is enclosed in double quotes, but the instructions do not require shell-free argument execution or define escaping and validation rules. If an implementation constructs a command string by directly replacing `<request>` with attacker-controlled text and then passes that string to a shell, embedded quotation marks, command substitutions, or other shell metacharacters could escape the intended argument context. The model identifier could present a similar risk if it is not constrained to a validated model selected from the Portal catalog. Exploitability depends on how the Agent invokes the command. Passing each value as a separate argument directly to a process API would prevent shell interpretation; interpolating the values into a shell string could make the template vulnerable. ### Attack Path 1. An attacker supplies or influences a chat request containing shell metacharacters or syntax that terminates the quoted `-q` argument. 2. The user approves the documented one-off invocation. 3. The Agent substitutes the request directly into the command template. 4. The Agent executes the resulting string through a command shell rather than using a shell-free argument array. 5. The shell interprets the injected syntax and executes unintended local commands. ### Impact Assessment Under the vulnerable execution pattern, injected commands would run with the operating-system privileges of the Hermes Agent pro ...[truncated 417 chars]
Remediation
## Remediation Suggestions - Invoke `hermes` through a process API that accepts an argument array, with shell execution disabled. - Pass `chat`, `--provider`, `nous`, `--model`, the validated model identifier, `-q`, and the request as distinct arguments. - Do not generate a shell command by concatenating or interpolating request text. - Restrict model identifiers to exact values obtained from the trusted Portal catalog or enforce a strict allowlist syntax. - If a shell is unavoidable, use platform-specific escaping designed for the exact shell and reject malformed model identifiers. - Add adversarial tests covering quotation marks, command substitutions, newlines, pipes, redirection operators, and platform-specific metacharacters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.