native-mcp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This design contains multiple high-risk features that enable intentional abuse — arbitrary subprocess installs/exec (npx/uvx), persistent remote HTTP/stream connections, automatic injection of discovered tools into all conversations, and configurable env/headers — which together make remote code execution, credential theft, and data exfiltration straightforward and usable as a backdoor or supply-chain attack vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be ingested during startup tool discovery: Hermes reads mcp_servers and then connects to each configured MCP server (stdio via spawned subprocess or HTTP via URL) and calls list_tools(), which returns tool metadata/content authored by the MCP server operator and is then registered/injected into the agent’s LLM tool context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill spawns subprocesses at runtime that fetch and run npm packages (e.g., "npx -y @modelcontextprotocol/server-filesystem" / "npx -y @modelcontextprotocol/server-github") and also connects at runtime to user-provided MCP HTTP endpoints (e.g., "https://mcp.example.com/mcp", "https://mcp.mycompany.com/v1/mcp") — both patterns cause remote code or tool descriptions to be fetched and executed/registered during runtime, meeting the criteria for an external dependency that can control agent behavior.