Hermes Code Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed bridge for local coding CLIs, but its command-dispatch examples include risky shell and tmux prompt interpolation that users should review before installation.

Install only if you want Hermes to drive local coding CLIs on your machine. Keep approval prompts enabled by default, review the exact backend, working directory, session, and prompt before side-effectful runs, and avoid using the raw shell/tmux templates with untrusted or multiline text unless they are rewritten to pass arguments or input through safer channels.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:403

Finding

Command Injection Through Unsafe Shell and tmux Prompt Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 403 and 426
Vulnerability Type: Command injection through untrusted string interpolation
Risk Level: Medium

Vulnerable Code

bash

tmux send-keys -t <SESSION_NAME> "<PROMPT>" Enter

python

terminal(command="cd <PROJECT_DIR> && <AGENT_CMD> <FLAGS> '<PROMPT>'", background=True, notify_on_complete=True)

Technical Analysis

The documented command templates directly interpolate prompt text, paths, session names, executable names, and flags into shell command strings or tmux keystrokes.

In the terminal example, a prompt containing a single quote followed by shell syntax can terminate the quoted argument and append an unintended command. Shell metacharacters in other interpolated fields, including PROJECT_DIR, AGENT_CMD, or FLAGS, can similarly alter command structure.

The tmux example sends the interpolated prompt as terminal input followed by Enter. Embedded newlines or terminal control sequences could cause the target shell or interactive CLI to receive additional commands rather than one literal prompt. Although the document warns that quotes and newlines must be escaped, it does not provide or enforce a safe encoding mechanism.

This is an insecure orchestration pattern rather than an embedded malicious payload. Exploitation occurs if an implementation follows these templates with attacker-controlled or insufficiently validated values.

Attack Path

1. An attacker supplies a crafted task prompt, project path, session name, agent command, or flags value.
2. Hermes inserts that value into one of the documented command templates without robust argument separation or validation.
3. The shell interprets injected quotes, substitutions, separators, or redirections as command syntax; alternatively, tmux transmits injected newlines as additional terminal submissions.
4. The injected ...[truncated 1355 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid shell command construction

   • Invoke processes with an argument array rather than a shell-formatted string.
   • Pass the working directory through a dedicated cwd parameter instead of constructing cd ... && ....
   • Disable shell interpretation whenever the execution API supports it.

2. Pass prompts through safe channels

   • Supply prompts as a distinct process argument when the process API preserves argument boundaries.
   • For large or multiline prompts, use standard input or a securely created temporary file.
   • Create temporary files with restrictive permissions and remove them after use.

3. Harden tmux dispatch

   • Do not interpolate arbitrary text into tmux send-keys.
   • Store the exact prompt in a securely created file and use tmux load-buffer followed by tmux paste-buffer.
   • Validate tmux target names against a strict allowlist and avoid forwarding terminal control characters.
   • Deliberately send Enter only after the literal buffer has been pasted and the target pane has been verified.

4. Validate command components

   • Resolve backend executables from a fixed allowlist such as codex, kimi, claude, opencode, or gemini.
   • Represent flags as separately validated arguments rather than free-form strings.
   • Validate session identifiers using a conservative character allowlist.
   • Canonicalize and verify project paths before dispatch.

5. Preserve approval controls

   • Keep --yolo, automatic approval, sandbox bypass, and equivalent options disabled by default.
   • Require explicit user confirmation immediately before using an approval-bypass mode.
   • Display the resolved executable, working directory, session target, and structured arguments before side-effectful execution.

6. Add adversarial tests

   • Test prompts and paths containing single and double quotes, semicolons, command substituti ...[truncated 203 chars]

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

bash

# If supported by the installed CLI
codex --help
codex exec --help
codex resume --help

# Common local archive patterns; inspect read-only

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

bash

# One-shot non-interactive
codex exec "<PROMPT>"

# One-shot with automatic approval if supported by the installed version
codex exec --ask-for-approval never "<PROMPT>"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The example codex exec --ask-for-approval never demonstrates disabling approval prompts for an external coding agent. If used on side-effectful tasks, this can allow file modification, command execution, or other agent actions to proceed without human review, increasing the chance of destructive changes or unsafe tool use.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md

codex exec "<PROMPT>"

# One-shot with automatic approval if supported by the installed version
codex exec --ask-for-approval never "<PROMPT>"

# Run from a project directory if supported
codex exec -C <PROJECT_DIR> "<PROMPT>"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

codex exec --ask-for-approval never "<PROMPT>"

# Run from a project directory if supported
codex exec -C <PROJECT_DIR> "<PROMPT>"

# Resume an explicit session if supported
codex exec resume <SESSION_ID> "<PROMPT>"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md

codex exec -C <PROJECT_DIR> "<PROMPT>"

# Resume an explicit session if supported
codex exec resume <SESSION_ID> "<PROMPT>"

# JSON output for easier parsing if supported
codex exec --json -o <OUTPUT_JSONL> "<PROMPT>"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

codex exec resume <SESSION_ID> ""

JSON output for easier parsing if supported

codex exec --json -o <OUTPUT_JSONL> ""

text

Automation notes:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

bash

# One-shot print mode
claude -p "<PROMPT>"

# With explicit working directory if supported
claude --cwd <PROJECT_DIR> -p "<PROMPT>"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

claude -p "<PROMPT>"

# With explicit working directory if supported
claude --cwd <PROJECT_DIR> -p "<PROMPT>"

# Inspect supported session/resume flags
claude --help

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 619)May include surrounding context.

bash

cd <PROJECT_DIR>
codex exec "Read-only review: inspect the current git diff and identify correctness, security, and maintainability risks. Do not modify files. Report file paths, line references when possible, severity, and recommended fixes."

Report:

Static analysis

No suspicious patterns detected.