audit-approval-bypass

name	audit-approval-bypass
description	Audit every path that bypasses dangerous-command approval — YOLO, approvals off, command_allowlist entries, cron approve mode, container backends
when_to_use	["User asks to audit approval / bypass configuration","Scheduled monthly security check","After choosing \"always\" on an approval prompt"]
security	{"trust":"trusted","notes":"Read-only audit of config.yaml and ~/.hermes/cron/jobs.json. Never modifies the\napproval posture without explicit confirmation.\n"}
model_hint	google/gemini-3.7-flash
toolsets	["terminal","file"]

audit-approval-bypass — Verify Approval Posture

Approval bypass is how power users make trusted automation run unattended. It's also how attackers escalate if misconfigured. This skill catches drift.

Hermes' approval layer is the built-in dangerous-command detector plus the top-level approvals: and command_allowlist: blocks — there is no security.approval.bypass_subagents / require_approval regex config (Part 19, Layer 2). The bypass surfaces that actually exist are the ones below.

Procedure

1. Load ~/.hermes/config.yaml and capture:

   • approvals.mode (manual / smart / off)
   • approvals.timeout and approvals.cron_mode (deny / approve)
   • The full command_allowlist: (every entry is a standing "always approve")
   • terminal.backend (container backends skip approval entirely — by design)
   • security.redact_secrets

2. Flag config-level bypasses:

   • 🔴 approvals.mode: off — equivalent to permanent --yolo.
   • 🔴 approvals.cron_mode: approve — headless cron jobs auto-approve dangerous commands.
   • 🟡 approvals.mode: smart on a deployment that reads untrusted input — the auxiliary risk-assessor is itself operating on attacker-influenced strings.
   • 🟡 Any broad command_allowlist entry (e.g. recursive delete, shell command via -c/-lc flag) — these approve every future match, including paths you didn't intend.
   • 🟡 security.redact_secrets: false.

3. Check environment bypasses:

   • HERMES_YOLO_MODE set in ~/.hermes/.env or the service unit (check the systemd unit's Environment= lines).
   • Any wrapper script / alias invoking hermes --yolo.

4. Check the container caveat:

   • If terminal.backend is docker / singularity / modal / daytona, dangerous-command checks are skipped — the container is the boundary. Verify that's intentional: flag if docker_mount_cwd_to_workspace: true or a broad host mount undermines it.

5. Cross-check cron. For each job in ~/.hermes/cron/jobs.json (inspect with hermes cron list), flag any task that can hit shell writes while is set, or that reads untrusted content (inbox sweeps, web scrapes) headlessly.

Notes

• The hardline UNRECOVERABLE_BLOCKLIST (rm -rf /, fork bomb, mkfs on root, …) cannot be bypassed by any of the above — it's the floor, not the posture. Don't report it as configurable.
• If approvals: is missing entirely, that's fine — defaults are mode: smart, timeout: 300, cron_mode: deny and single_query_mode: deny. Flag only explicit weakening — especially mode: off (permanent --yolo) or cron_mode: approve.
• Cross-check with the audit-mcp skill's output — an MCP with a broad tool surface plus approvals.mode: off is the worst-case combination.