T08 · Insecure Dependencies
Warning
- Location
- README.md:24
- Finding
- Unpinned Third-Party Plugin Installation## Vulnerability Details **File Location**: `README.md`, lines 24–29 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown Hermes can also install both skills plus the MCP URL as one Agent Plugins v1 package: ```bash hermes plugins install teakesdev/corpus-agent-kit/plugins/corpus hermes plugins enable corpus ``` ``` ### Technical Analysis The documentation instructs users to download and enable a third-party Hermes plugin using a mutable repository reference. The command does not pin the dependency to a version, commit digest, checksum, or cryptographically verified signature. The plugin implementation is not included in the audited artifact, which contains only `README.md` and `SKILL.md`. Consequently, the plugin's code, permissions, transitive dependencies, and future behavior cannot be verified from this project. Even if the upstream source is currently benign, its effective payload can change after this audit through repository compromise, maintainer-account compromise, malicious updates, or dependency substitution. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, its distribution infrastructure, or a transitive dependency. 2. The attacker modifies the plugin content associated with the mutable installation reference. 3. A user follows the documented `hermes plugins install` command. 4. Hermes downloads the changed, unaudited plugin rather than an immutable audited revision. 5. The user runs `hermes plugins enable corpus`. 6. The malicious plugin executes or influences Agent behavior with whatever tools, data, network access, and local permissions the Hermes plugin environment grants it. ### Impact Assessment The exact impact depends on the Hermes plugin security model and the permissions granted at installation or runtime. A compromised plugin could potentially alter Agent instructions, register ...[truncated 461 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the plugin to an immutable, reviewed release version or commit digest rather than a mutable repository path. 2. Publish a cryptographic checksum or signature and document verification before installation. 3. Include the exact plugin source in the audited release artifact, or link to an immutable source archive matching the pinned digest. 4. Document the plugin's requested permissions, registered tools, network destinations, local filesystem access, and transitive dependencies. 5. Use a trusted package registry or release channel that supports provenance attestations and signed artifacts. 6. Add automated dependency and provenance verification to the release process. 7. Advise users to review the pinned plugin source and permissions before enabling it.