Hermit Search Publish

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:17 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for local semantic search, but its install path asks users to run mutable third-party code and download unverified model assets.

Install only if you trust the Hermit GitHub repository and are comfortable running its current code. Prefer a pinned commit or signed release, verify model sources where possible, and index only specific folders that do not contain credentials, private keys, browser profiles, tokens, or unrelated sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Installation and Unverified Model Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–40
Vulnerability Type: Supply-chain exposure through mutable upstream dependencies
Risk Level: Medium

Vulnerable Code

sh

uv tool install git+https://github.com/xxxgqcoder/hermit.git
# Deploy the skill to ~/.agents/skills/hermit-search/ (optional, for automatic agent discovery)
hermit install-skills

sh

hermit download

Technical Analysis

The installation command retrieves executable Python package content directly from the default branch of a third-party Git repository. It does not pin an immutable commit, a signed release, or a versioned artifact, and it performs no checksum or signature verification. Consequently, the code installed by this instruction can change after the skill has been reviewed.

The subsequent hermit download command retrieves approximately 1 GB of model artifacts through the newly installed tool. The document does not identify immutable model revisions or provide expected cryptographic hashes. Because the audited project contains only SKILL.md and does not include the Hermit implementation, the destination URLs, transport controls, artifact validation, and execution behavior cannot be independently verified from this project.

This is a supply-chain weakness rather than proof that the current upstream project is malicious.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, release infrastructure, or another dependency in its installation chain.
2. The attacker modifies the repository's mutable default branch to include malicious package installation or runtime behavior.
3. A user follows the documented uv tool install git+https://github.com/xxxgqcoder/hermit.git instruction after the malicious update.
4. The package manager retrieves and installs the attacker-controlled revision without verifying a project-specified commit or artifact hash.
5. The malicious package executes during installation ...[truncated 1338 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable Git installation reference with an immutable, reviewed commit:

   sh

   uv tool install "git+https://github.com/xxxgqcoder/hermit.git@<reviewed-full-commit-sha>"
   

2. Prefer a versioned release from a trusted package registry with locked transitive dependencies and hash verification.

3. Require signed commits or releases and document how users should verify the maintainer signature.

4. Publish SHA-256 or stronger hashes for all distributed package and model artifacts, and fail closed if verification fails.

5. Pin each model by repository, immutable revision, and exact artifact filename rather than relying on mutable model aliases.

6. Document the external hosts contacted by hermit download and the expected files, sizes, revisions, and checksums.

7. Review the pinned Hermit source and dependency lock file before recommending installation.

8. Run the service under a dedicated, unprivileged account with access limited to explicitly selected knowledge-base directories.

9. Avoid indexing directories containing credentials, private keys, tokens, browser profiles, or other unrelated sensitive data.

10. Provide a reproducible or vendored installation option so the reviewed source corresponds exactly to the installed program.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description states instructions in Chinese and the rest of the document continues in Chinese, but there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This creates a natural-language policy issue because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.