メニュー
Static + LLM code audit of a skill/tool source into FAIL/WARN/PASS. Never executes the code. The first guard in the dynamic ingestion pipeline (#6, Phase 4).
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Branch, commit, push, and open PRs with humanized messages, then monitor GitHub Actions CI. Per-project autonomy gating; blocks direct pushes to the default branch and pushes with a dirty tree. Never auto-merges.
Dispatch patterns for Claude Code as the coding engine. Default harness. Implementation dispatches go through dispatch_coder.py (writes the dispatch receipt the commit gate requires).
Testing strategy, TDD enforcement, spec compliance, and regression checks.
Write implementation plans: bite-sized tasks for coding engine dispatch.
Automated fix loop for failed Quality/Reviewer checks. Parses failures, builds escalating prompts, dispatches through the active harness up to 3 times.
Run independent, file-disjoint plan tasks concurrently, each isolated in its own git worktree + branch. Collects per-task results; never auto-merges.
| name | security-auditor |
| description | Static + LLM code audit of a skill/tool source into FAIL/WARN/PASS. Never executes the code. The first guard in the dynamic ingestion pipeline (#6, Phase 4). |
| version | 1.0.0 |
| platforms | ["linux","macos","windows"] |
| metadata | {"hermes":{"tags":["security","audit","static-analysis","llm","supply-chain","skills","mcp","vetting"],"related_skills":["security","reviewer","vetted-vault","skill-ingest","skill-discovery"]}} |
The first guard of the dynamic skill/tool ingestion pipeline (Backlog #6, Phase 4). It reviews a
source tree for dangerous patterns and returns a FAIL | WARN | PASS verdict without ever
executing the code. Two phases:
FAIL. Categories: code execution (eval/exec/os.system/
shell=True/pickle.loads/child_process.exec), obfuscation (base64/hex feeding exec, long
opaque literals), sensitive-path/credential access (~/.aws, ~/.ssh, id_rsa, keychain,
browser cookies, *_TOKEN/*_KEY env dumps), and network egress (WARN: requests.post,
urllib, socket, fetch, URLs, hardcoded IPs, curl/wget/nc).--engine/coding.default_engine). Corroborates/escalates; a clean static scan is
not overridden to FAIL by a missing LLM. If the harness is down, Phase B is skipped and the
static-only verdict still gates (exit 3).Aggregate: any FAIL (static or LLM) → FAIL; else any WARN → WARN; else PASS.
The auditor never executes the source it reviews. Execution happens later, sandboxed, via the
container-runner. A FAIL verdict must hard-block vaulting/injection.
terminal(command="python3 ~/.hermes-coder/scripts/security_auditor.py --source '<path>' --json", workdir="~/.hermes-coder", timeout=120)
Static-only (no LLM pass):
terminal(command="python3 ~/.hermes-coder/scripts/security_auditor.py --source '<path>' --static-only --json", workdir="~/.hermes-coder", timeout=30)
Flags: --engine (coding harness for the LLM pass; default coding.default_engine), --model
(deprecated/ignored — the LLM pass uses the harness), --max-llm-files (default 12), --static-only,
--json.
--json)AuditReport: source, verdict (FAIL|WARN|PASS), static_findings[] (file, line,
severity, category, snippet), llm_findings[], llm_used, model (the resolved harness),
plus harness_down.
Gate on the verdict field, not just the exit code — WARN exits 0.
| Code | Meaning |
|---|---|
| 0 | PASS or WARN (non-blocking) |
| 1 | FAIL (blocked) |
| 2 | Invalid arguments / source not found |
| 3 | LLM harness unavailable during the LLM pass (static-only verdict provided) |
If the LLM harness is down, the audit still runs static-only and emits a verdict (exit 3). The static phase carries the blocking weight, so a malicious source is still caught without the LLM.