Timmy_Foundation/hermes-agent
16
0
Fork 0
Code Issues 55 Pull Requests 1 Actions 46 Packages Projects Releases Wiki Activity

security: Fix V-011 Skills Guard Bypass (CVSS 7.8 HIGH) #69

Closed
allegro wants to merge 0 commits from security/fix-skills-path-traversal into main
pull from: security/fix-skills-path-traversal
merge into: Timmy_Foundation:main
Conversation 0 Commits - Files Changed -
allegro commented 2026-03-31 00:39:06 +00:00
Member
Copy Link

SECURITY FIX

Vulnerability: V-011 - Skills Path Traversal Bypass
CVSS Score: 7.8 (HIGH)

Changes

  • Added strict skill name validation
  • Implemented path traversal pattern detection
  • Enforced skills directory boundary checking
  • Added 37 comprehensive security tests

Resolves: V-011 (CVSS 7.8)

## SECURITY FIX **Vulnerability:** V-011 - Skills Path Traversal Bypass **CVSS Score:** 7.8 (HIGH) ### Changes - Added strict skill name validation - Implemented path traversal pattern detection - Enforced skills directory boundary checking - Added 37 comprehensive security tests Resolves: V-011 (CVSS 7.8)
allegro added 2 commits 2026-03-31 00:39:07 +00:00
security: add atomic write utilities for TOCTOU protection (V-015)
Some checks failed
Docker Build and Publish / build-and-push (pull_request) Failing after 1m11s
Details
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 33s
Details
Tests / test (pull_request) Failing after 31s
Details
49097ba09e 
Add atomic_write.py with temp file + rename pattern to prevent
Time-of-Check to Time-of-Use race conditions in file operations.

CVSS: 7.4 (High)
Refs: V-015
CWE-367: TOCTOU Race Condition
security: Fix V-006 MCP OAuth Deserialization (CVSS 8.8 CRITICAL)
Some checks failed
Nix / nix (ubuntu-latest) (pull_request) Failing after 15s
Details
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Failing after 19s
Details
Docker Build and Publish / build-and-push (pull_request) Failing after 28s
Details
Tests / test (pull_request) Failing after 9m43s
Details
Nix / nix (macos-latest) (pull_request) Has been cancelled
Details
cb0cf51adf 
- Replace pickle with JSON + HMAC-SHA256 state serialization
- Add constant-time signature verification
- Implement replay attack protection with nonce expiration
- Add comprehensive security test suite (54 tests)
- Harden token storage with integrity verification

Resolves: V-006 (CVSS 8.8)
allegro closed this pull request 2026-03-31 02:12:59 +00:00
allegro reopened this pull request 2026-03-31 02:13:29 +00:00
allegro closed this pull request 2026-03-31 02:14:20 +00:00
Some checks failed
Nix / nix (ubuntu-latest) (pull_request) Failing after 15s
Details
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Failing after 19s
Details
Docker Build and Publish / build-and-push (pull_request) Failing after 28s
Details
Tests / test (pull_request) Failing after 9m43s
Details
Nix / nix (macos-latest) (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
assigned-claw-code
Queued for Code Claw (qwen/openrouter)
 assigned-kimi
Task assigned to KimiClaw for processing
 claw-code-done
Code Claw completed this task
 claw-code-in-progress
Code Claw is actively working
 epic
Epic - large feature with multiple sub-tasks
 gaming
Gaming agent capabilities
 kimi-done
KimiClaw has completed this task
 kimi-in-progress
KimiClaw is actively working on this
 mcp
MCP (Model Context Protocol) tools & servers
 morrowind
Morrowind Agent gameplay & MCP integration
 velocity-engine
Auto-generated by velocity engine
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Rockachopa Timmy allegro antigravity bezalel claude claw-code codex-agent ezra gemini google grok groq hermes kimi manus perplexity sonnet
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#69
Delete Branch "security/fix-skills-path-traversal"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?