Files
hermes-agent/tests/tools
Brooklyn Nicholson 0f24f8b8eb fix(skills-guard): detect bare-~ destructive rm and inline-shell auto-exec DSL
The skills security scanner had two blind spots (#63307 Part A):

1. destructive_home_rm only matched literal $HOME, not bare ~. A command
   like 'rm -rf ~/Documents' scanned as safe for every trust tier.

2. No pattern detected the !`cmd` inline-shell DSL that
   agent/skill_preprocessing.py expands via bash -c on skill view/load.
   A skill carrying !`rm -rf ~/Documents` scanned safe.

Fix: extend destructive_home_rm to match ~/~ /~* (bare tilde forms),
add an inline_shell_exec pattern for the !`...` auto-exec snippet
(requires a non-space payload so a skill explaining the DSL is not
flagged), and bump SCANNER_VERSION to skills-guard-v7 so cached safe
verdicts are invalidated.

Also stop swallowing the scan verdict on the TUI-gateway skills.manage
install RPC (#63307 Part B): _skills_install returned installed:true on
every path, including a security-scan block, because its console was a
sink. It now keys the response off do_install's verdict and answers an
error envelope (5031) whose message/data carry the printed tail — the
scan verdict, the ambiguity candidate table, or the fetch failure —
instead of a silent success.

The Desktop one-click hub install path gets the same treatment from the
spawned CLI's exit code (hub-actions.ts already parses it).

Original scanner patterns by the PR author.

Co-authored-by: liuhao1024 <sunsky.lau@gmail.com>
2026-09-29 20:57:45 -05:00
..