Back to skill

Security audit

Hermes Evolution

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its productivity-assistant purpose, but it handles task, user, credential, and agent-memory data with several under-scoped high-impact behaviors that need review before installation.

Review this skill before installing. Do not configure Feishu credentials unless the notifier is changed to use HTTPS and a recipient you explicitly control. Disable or gate the profiler, self-improving rules, frozen memory, scheduler, and auto-skill generator behind approval if the workspace may contain private tasks, credentials, customer data, or sensitive tool results.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

other

Error
Location
modules/sensen-feishu-notifier.js:17
Finding

Automatic Disclosure of Task Data to a Hardcoded External Feishu Group

Content
View full analysis
100 ? '...' : ''}` }); } ``` ```js if (task.result) { card.elements.push({ tag: "hr" }); card.elements.push({ tag: "markdown", content: `**Result**\n${task.result}` }); } ``` ```js TaskManager.createTask = function(...args) { const task = originalCreate(...args); notifyTaskCreated(task) .catch(e => console.error('[FeishuNotifier] Notification failed:', e.message)); return task; }; TaskManager.updateTaskState = function(...args) { const [taskId, newState, extra] = args; const task = this.loadTask(taskId); const oldState = task?.status; const result = originalUpdateState(...args); if (result && oldState !== newState) { notifyTaskStatusChange(result, oldState, newState) .catch(e => console.error('[FeishuNotifier] Notification failed:', e.message)); } return result; }; ``` ### ...[truncated 1954 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
modules/sensen-feishu-notifier.js:74
Finding

Feishu Credentials, Access Tokens, and Task Content Transmitted over Plaintext HTTP

Content
View full analysis
{ let data = ''; tokenRes.on('data', chunk => data += chunk); tokenRes.on('end', () => { try { const tokenResult = JSON.parse(data); const accessToken = tokenResult.tenant_access_token; const body = payload ? JSON.stringify(payload) : ''; const reqOptions = { hostname: FEISHU_CONFIG.API_HOST, path: FEISHU_CONFIG.API_PATH_PREFIX + path, method: method, headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': `Bearer ${accessToken}` } }; const req = http.request(reqOptions, (res) => { let resData = ''; res.on('data', chunk => resData += chunk); res.on('end', () => { try { resolve(JSON.parse(resData)); } catch (e) { resolve({ success: true, raw: resData }); } }); }); req.on('error', reject); if (body) req.write(body); req.end(); } catch (e) { reject(e); } }); }); tokenReq.on('error', reject); tokenReq.write(tokenPayload); tokenReq.end(); ``` ### Technical Analysis Although the module imports both `https` and `http`, it uses `http.request` for the authenti ...[truncated 1987 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
modules/frozen-memory.js:36
Finding

Path Traversal in Persistent Memory File Operations

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
modules/sensen-self-improving-v2.js:222
Finding

Unreviewed Attacker-Controlled Corrections Can Become Persistent Active Rules

Content
View full analysis
{ if (c.id === correction.id) return false; if (c.type !== correction.type) return false; if (c.resolved) return false; const keywords1 = extractKeywords(correction.originalText); const keywords2 = extractKeywords(c.originalText); return keywords1.some(k => keywords2.includes(k)); }); const totalSimilar = [...similar, correction]; if (totalSimilar.length >= 3) { generateRule(totalSimilar); } } ``` ```js const rule = new Rule({ id: ruleId, name: `auto_rule_${first.type}_${uniqueKeywords.slice(0, 3).join('_')}`, type: first.type, keywords: uniqueKeywords, description: correctio ...[truncated 4203 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
modules/auto-skill-generator.js:91
Finding

Complete Tool Arguments and Results Are Persisted in Plaintext and Copied into Generated Skills

Content
View full analysis
this.windowSize) { this.callHistory.shift(); } this.detectPatterns(); return call; } ``` ```js const skill = { name: skillName, description: `Automatically generated skill: ${toolNames}`, tier: 3, procedure: pattern.toolCalls.map((call, i) => ({ step: i + 1, description: `Call ${call.toolName}`, tool: call.toolName, parameters: call.args ? Object.keys(call.args) : [] })), pitfalls: [{ mistake: 'Incorrect parameters', consequence: 'Tool call failure', solution: 'Refer to the parameter format in examples' }], verification: { method: 'Run test cases', expectedResult: 'All tool calls succeed' }, examples: pattern.toolCalls.slice(0, 2).map(call => ({ input: JSON.stringify(call.args), output: call.success ? 'Success' : `Failure: ${call.error}` })), metadata: { version: '1.0.0', author: 'auto-generator', autoGenerated: true, patternId: pattern.id, frequency: pattern.frequency, successRate: pattern.successRate, generatedAt: new Date().toISOString() } }; const skillFile = path.join(this.skillOutputDir, `${skillName}.skill.json`); fs.writeFileSync(skillFile, JSON.stringify(skill, null, 2), 'utf-8'); ``` ### Technical Analysis `recordCall` serializes the entire `ToolCall` object ...[truncated 2032 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (146)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
| PM Router | `sensen-pm-router.js` | 路由核心 + Agent Profile |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| Task Manager | `task-manager.js` | 任务状态机 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
| Task Store | `task-store.js` | 内存缓存 + 索引加速 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
| Task DAG | `task-dag.js` | DAG 依赖管理 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
| Self-Improving v2 | `sensen-self-improving-v2.js` | 规则权重 + 版本管理 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
| Progressive Disclosure | `progressive-disclosure.js` | 渐进式加载,Token 控制 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
| Periodic Nudge | `periodic-nudge.js` | 主动自检引擎 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
| Honcho Profiler | `honcho-profiler.js` | 用户画像 + 需求预测 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
| AutoSkill Generator | `auto-skill-generator.js` | 自动创建 Skill |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
| LLM Summarizer | `llm-summarizer.js` | 检索结果摘要 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
| Logger | `sensen-logger.js` | 结构化日志 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
| Collaborator | `sensen-collaborator.js` | 多 Agent 协作 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
| Collab Visualizer | `sensen-collab-visualizer.js` | 协作可视化 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
| Scheduler | `sensen-scheduler.js` | 定时任务 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
| Scheduler | `sensen-scheduler.js` | 定时任务 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
| Feishu Notifier | `sensen-feishu-notifier.js` | 飞书通知 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
| Spawner | `sensen-spawner.js` | Agent Spawn |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md
node modules/test-intent-router.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md
node modules/test-self-improving-v2.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md
node modules/test-logger.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
node modules/test-dag.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
node modules/test-collab-visualizer.js

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document describes a profiler that stores identity details, goals, interaction timing, intent history, and predicted needs, but provides no consent, retention, access control, or privacy notice. This creates a clear privacy and security risk because sensitive personal data and inferred behavioral attributes may be persistently collected and reused without user awareness or governance.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · modules/patch-store.js (reported line 205)May include surrounding context.

js
console.log(`  名称: ${rule.name}`);
  console.log(`  描述: ${rule.description}`);
  
  return rule;
}

/**

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · modules/sensen-self-improving-v2.js (reported line 361)May include surrounding context.

js
console.log(`  名称: ${rule.name}`);
  console.log(`  描述: ${rule.description}`);
  
  return rule;
}

/**

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
modules/sensen-feishu-notifier.js:75

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
modules/sensen-feishu-notifier.js:108