ClawHub
Back to skill

Security audit

Hermes Dashboard Extension Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent scaffold generator, but its generated dashboard files can embed untrusted spec values as executable Python or browser-rendered HTML.

Install only if users will supply trusted specs or review generated files before use. Treat generated backend and frontend stubs as untrusted until api_route is safely encoded or strictly validated and tab/slot values are HTML-escaped.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/hermes_dashboard_extension_builder.py:36
Finding

Python Code Injection in Generated Backend Route

Content
View full analysis
route namespace.'}) ``` ### Technical Analysis The `api_route` value may originate from an attacker-controlled JSON specification. It is inserted directly into generated Python source code inside a double-quoted string literal. Validation only requires that the value begin with `/api/`. It does not reject quotation marks, backslashes, line breaks, comments, or other Python syntax. Consequently, a crafted value can terminate the generated string, close the return expression, and append arbitrary Python statements. For example, a route beginning with `/api/` could contain a closing quote followed by a newline and Python statements. The generated file would then contain attacker-selected executable code rather than only a route constant. Because this is source-code generation rather than ordinary data serialization, the payload can execute when the generated module is imported, run directly, or invoked by the dashboard backend. ### Attack Path 1. An attacker creates or modifies a JSON specification supplied through `--spec`. 2. The attacker sets `api_route` to a value that starts with `/api/` but contains a quote, newline, and injected Python statements. ...[truncated 989 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/hermes_dashboard_extension_builder.py:34
Finding

HTML Injection in Generated Dashboard Frontend

Content
View full analysis
\n

{spec['tab']}

\n

Mounted in slot: {spec['slot']}

\n
text
Loading...
\n\n""", encoding='utf-8') ``` The `tab` and `slot` values are obtained from the specification without HTML validation or encoding: ```python return { 'name': name, 'tab': spec.get('tab') or args.tab or name.replace('-', ' ').title(), 'slot': spec.get('slot') or args.slot, 'api_route': spec.get('api_route') or args.api_route or f'/api/{name}', 'theme': spec.get('theme') or 'system', 'permissions': spec.get('permissions') or ['read:status'], } ``` ### Technical Analysis The generator inserts `tab` and `slot` directly into HTML text contexts. These fields can originate from an attacker-controlled JSON specification, and `validate()` does not inspect or constrain either field. An attacker can provide markup such as a closing element followed by a script-capable HTML element. The payload is written verbatim to the generated frontend file. If the scaffold is subsequently served or incorporated into a dashboard without additional sanitization, the browser interprets the injected content as markup rather than text. Whether JavaScript executes depends on how the generated fragment is integrated and on browser defenses such as Content Security Policy. Even where scripts are blocked, an attacker may still inject misleading interface content, links, forms, images, or other unauthorized markup. ### Attack Path 1. An attacker creates or modifies a specification supplied through `--spec`. 2. The attacker places malicious HTML in the `tab` or `slot` field. 3. The generator performs no HTML e ...[truncated 999 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code creates directories and writes several files, including extension.json, frontend HTML, backend Python, and VALIDATION.json. Although file generation is the script's purpose, there is no visible confirmation prompt, log message, or warning disclosing the exact filesystem changes before they occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.