Skills/ClawHub/tencent-ima-hermes

tencent-ima-hermes@1.0.2

CAUTION· install only

Publisher claims: "腾讯 IMA OpenAPI 技能（笔记 + 知识库）。当用户提到知识库、资料库、笔记、备忘录、记事， 或者想上传文件到知识库、添加网页/微信文章到知识库、搜索知识库内容、搜索/浏览/创建/编辑 笔记时，使用此 skill。即使用户没有明确说"知识库"或"笔记"，只要意图涉及文件上传到 知识库、网页收藏、知识搜索..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher wat2012 · publishing for 161 daysInstalls 785Last detonated 5 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Credential pass-through configuration; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedSKILL.md:285 · Python subprocess execution detectedr2 = subprocess.run(["/home/jerome/.hermes/skills/ima/bin/ima",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsSKILL.md:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭证检查只看 `~/.config/ima/*` 文件**——`ima_api.cjs` 实际是 `options > env > file` 三级优先（行 29-38），用户经常 `~/.hermes/.env` 配凭证由 shell 导出，**只测文件就报"凭证缺"会误导用户**。检查必须先 env 再 file（见 Credential Check 段）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationSKILL.md:381 · Credential pass-through configuration — agent relays sensitive credentials# Example usage (cross-platform, pass credentials via options JSON)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionknowledge-base/scripts/cos-upload.cjs:128 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Upload successful (HTTP ${res.statusCode})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsbin/ima.sh:472 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files从 ~/.hermes/.env 自动加载 IMA_OPENAPI_CLIENTID / IMA_OPENAPI_APIKEYFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedSKILL.md:83 · Python subprocess execution detected…极低，`--force` 几乎用不到。 > 4. **subprocess shell=True 中文文件名解析坑**（2026-06-05 实战）—— 用 `subprocess.run(["~/.hermes/skills/ima/bin/ima", "check-name", KB_ID, "A 股每日行情监控.md", ...], shel…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
README links to an external installerREADME.md → https://app-dl.ima.qq.com/skills/ima-skills-1.1.7.ziphttps://app-dl.ima.qq.com/skills/ima-skills-1.1.7.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsSKILL.md:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files> - 凭证路径对齐 Hermes `.env` 约定（`IMA_OPENAPI_CLIENTID` / `IMA_OPENAPI_APIKEY`）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files> 2. `grep -E 'IMA_OPENAPI_(CLIENTID|APIKEY)' ~/.hermes/.env` 看 .env 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…⚠️ 凭证缺，先补才能写操作" → 用户当场纠正"ima凭证是什么？我理解我配置 ima 技能的时候已经加入了。不是吗" → 实际凭证在 `~/.hermes/.env` + shell export 完整在位。 > 2. **不要把"凭证检测失败"扩大成"写操作前必须先补凭证"** —— 这是同一失误的连锁反应。看到 ⚠️ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsbin/ima.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 加载 ~/.hermes/.env（hermes 启动时会加载，子进程继承）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_kb_structure.py:47 · Python subprocess execution detectedr = subprocess.run(["node", "-e", node_code], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedSKILL.md:279 · Python subprocess execution detectedr = subprocess.run(["/home/jerome/.hermes/skills/ima/bin/ima",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsbin/ima.sh:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="${HERMES_ENV:-$HOME/.hermes/.env}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedSKILL.md:99 · Python subprocess execution detected…目录存在且权限正常。**绕道**：先 `cp` 到临时英文文件名 → `terminal` 走 `mv "tmp.md" "中文名.md"` 改名。或全程用 `subprocess.run(['cp', ...])` 走 terminal。**这**不是文件系统问题，是 hermes `execute_code` 沙箱的预检限制。 > > 详见 `…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈7,668 tok
1 file · 21 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim wat2012: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wat2012Propose a patch to the maintainer