Skills
Navigate
skills/reason-machines/hermes-skills/hermesclaw-wechat-multi-agent/Gen Agent Trust Hub

hermesclaw-wechat-multi-agent

Fail

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONPERSISTENCEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill promotes the use of curl -fsSL ... | bash to install the software. This pattern downloads a shell script from an untrusted GitHub repository (AaronWong1999/hermesclaw) and executes it immediately with shell privileges.\n- [CREDENTIALS_UNSAFE]: The installation logic is designed to search for and harvest sensitive iLink tokens from the configuration directories of other installed agents, specifically ~/.openclaw and ~/.hermes, storing them in a local .env file.\n- [PRIVILEGE_ESCALATION]: The skill instructs the user to use sudo to install a systemd service file in /etc/systemd/system/. This grants the application elevated system permissions beyond what is typically required for a message router.\n- [PERSISTENCE]: By installing a systemd service, the skill ensures that its proxy and routing logic remain active across system reboots and automatically restart if the process terminates.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a gateway for WeChat messages, creating a surface for indirect attacks where malicious instructions in a message could influence the behavior of the connected AI agents.\n
  • Ingestion points: Raw message content received from the WeChat iLink API in hermesclaw.py and the ProxyServer implementation.\n
  • Boundary markers: None identified; the skill forwards the raw message content to downstream agents without delimiters or warning instructions.\n
  • Capability inventory: The skill environment includes network access to the WeChat API, file system access for configuration, and subprocess execution for the OpenCode bridge.\n
  • Sanitization: The skill does not perform validation or sanitization on the message strings before routing them.\n- [EXTERNAL_DOWNLOADS]: The skill downloads components from external sources, including a non-trusted GitHub repository (github.com/AaronWong1999/hermesclaw) and the official Node.js registry for the opencode-ai package. It also communicates with the official WeChat iLink API service (ilinkai.weixin.qq.com).
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/AaronWong1999/hermesclaw/main/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 12, 2026, 06:50 PM
Security Audit — agent-trust-hub — hermesclaw-wechat-multi-agent