hermes-agent Security Audit Report
hermes-agent is an AI agent skill, created by nousresearch and published at nousresearch/hermes-agent. ClawSecure audited hermes-agent across 50 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 13 findings concentrate in Malicious Code, Code Injection and Permissions Manifest, including Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: MEMORY.md. 12 were rated high or critical severity.
Is hermes-agent safe?
ClawSecure audited hermes-agent and assigned a security score of 0/100 (High Risk), identifying 13 findings across Malicious Code and Code Injection. Review the findings below before installing.
What did ClawSecure find in hermes-agent?
ClawSecure identified 13 findings in hermes-agent, concentrated in Malicious Code, Code Injection and Permissions Manifest. 12 were rated high or critical severity. The most severe include Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: MEMORY.md.
How was hermes-agent audited?
ClawSecure ran hermes-agent through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 50 files from nousresearch/hermes-agent.
What does a score of 0 mean?
ClawSecure assigned hermes-agent a security score of 0/100, placing it in the High Risk range. This is driven by 13 findings led by Malicious Code that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for hermes-agent
ClawSecure detected 13 security findings in hermes-agent, spanning Malicious Code, Code Injection and Permissions Manifest.
- high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in
.env.example. - high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in
CONTRIBUTING.es.md. - high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in
CONTRIBUTING.md. - high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in
CONTRIBUTING.md. - high · Attempts to access sensitive file: SOUL.md. Malicious Code finding detected in
README.es.md. - high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in
README.es.md. - high · Attempts to access sensitive file: SOUL.md. Malicious Code finding detected in
README.md. - high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in
README.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
CONTRIBUTING.md. - high · Potentially dangerous code pattern detected: system\(. Code Injection finding detected in
CONTRIBUTING.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
README.es.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
README.md.
Showing the 12 highest-severity of 13 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for hermes-agent
Audit external network connections
Eliminate dynamic code execution
Add a config.json permissions manifest
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on July 22, 2026. hermes-agent is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.