Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Hermes Agent Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate-looking Hermes CLI wrapper, but it understates file access and enables broad agent capabilities without clear approval boundaries.
Review this skill before installing. Use it only if you trust the installed Hermes CLI and its configured model provider, and avoid passing sensitive files through --context-file unless you intend their contents to be processed by Hermes. Treat memory notes, created skills, and ~/.hermes/ configuration changes as persistent state that should be reviewed periodically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises powerful capabilities including browser automation, code execution, sub-agent delegation, MCP integration, and persistent memory without corresponding safety warnings or operational constraints. This is dangerous because users or orchestrating agents may invoke the skill without understanding that it can affect local state, access external systems, retain data across sessions, or execute untrusted actions indirectly through Hermes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill asserts Hermes only operates within '~/.hermes/' and performs no file operations outside that scope, but the documented '--context-file ./ctx.md' usage explicitly passes an arbitrary external file to the CLI. This is dangerous because it misleads users and downstream agents about the real file-access boundary, which can cause unintended disclosure of local file contents to the Hermes tool and its configured LLM/provider.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The documented 'hermes skills create' capability indicates the tool can create persistent artifacts that may influence future agent behavior, yet the skill does not warn about session persistence or trust implications. This is dangerous because persistent skills or notes can survive the current task, accumulate unreviewed instructions, and become a vehicle for prompt persistence or later unintended execution.
- Content
bash hermes skills list hermes skills create "name" --description "desc"Status
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The 'File Access Scope' section claims 'No direct file operations' and '
/.hermes/ only', yet the skill also instructs editing '/.hermes/.env', editing '~/.hermes/config.yaml', and supplying arbitrary context files outside that boundary. This inconsistency is dangerous because it understates the tool's ability to read user-selected files and alter persistent configuration, increasing the chance of unsafe invocation under false assumptions.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest includes trigger phrases in Chinese alongside English phrases, but there is no explanation of language handling, user opt-in, or locale scope. For language/locale policy, hard-coded language behavior should either offer a choice or clearly document the intended locale context.
- Content
Static analysis
No suspicious patterns detected.