扫描时间: Sat Jul 25 08:49:35 PM CST 2026 | 扫描范围: ~/.hermes/skills/
Snyk Agent Scan v0.5.15 --dangerously-run-mcp-servers is set: starting every stdio MCP server listed in the scanned configs without prompting. Tip: set --suppress-mcpserver-io=true to hide server stderr output. [codebase-memory-mcp] level=info msg=mem.init budget_mb=930 total_ram_mb=3723 [codebase-memory-mcp] level=info msg=server.start version=0.9.0 [codebase-memory-mcp] level=info msg=watcher.start interval_ms=multi-sec [codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc method=initialize status=ok duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=prompts/list status=error duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=resources/list status=error duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=resources/templates/list status=error duration_ms=0 [codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc method=tools/list status=ok duration_ms=0 [codebase-memory-mcp] level=info msg=server.shutdown [codebase-memory-mcp] level=info msg=watcher.stop [codebase-memory-mcp] level=info msg=mem.init budget_mb=930 total_ram_mb=3723 [codebase-memory-mcp] level=info msg=server.start version=0.9.0 [codebase-memory-mcp] level=info msg=watcher.start interval_ms=multi-sec [codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc method=initialize status=ok duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=prompts/list status=error duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=resources/list status=error duration_ms=0 [codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc method=resources/templates/list status=error duration_ms=0 [codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc method=tools/list status=ok duration_ms=0 [codebase-memory-mcp] level=info msg=server.shutdown [codebase-memory-mcp] level=info msg=watcher.stop ● Scanning /home/agentuser/.claude found 2 mcp servers and 17 skills │ ├── codebase-memory-mcp 4 findings (1 medium, 3 low) │ ● [W019 medium]: Destructive Capabilities. │ ● [W016 low]: Untrusted Content Retrieval. │ ● [W001 low]: Found the words "ignore","important","critical","override" in │ the tool description. It is a common word used in prompt injection attacks. │ ● [W018 low]: Workspace Data Exposure. │ ├── tool index_repository │ ├── tool search_graph │ ├── tool query_graph │ ├── tool trace_path │ ├── tool get_code_snippet │ ├── tool get_graph_schema │ ├── tool get_architecture │ └── tool search_code ├── mcp-search 3 findings (1 medium, 2 low) │ ● [W017 medium]: Sensitive Data Exposure. │ ● [W001 low]: Found the word "important" in the tool description. It is a │ common word used in prompt injection attacks. │ ● [W020 low]: Local Destructive Capabilities. │ ├── tool __IMPORTANT │ ├── tool search │ ├── tool timeline │ ├── tool get_observations │ ├── tool observation_add │ ├── tool observation_record_event │ ├── tool observation_search │ ├── tool observation_context │ ├── tool observation_generation_status │ ├── tool memory_add │ ├── tool memory_search │ ├── tool memory_context │ ├── tool smart_search │ ├── tool smart_unfold │ ├── tool smart_outline │ ├── tool build_corpus │ ├── tool list_corpora │ ├── tool prime_corpus │ ├── tool query_corpus │ ├── tool rebuild_corpus │ └── tool reprime_corpus ├── codebase-memory │ ● [X002 info]: could not inspect skill ├── learn-codebase 1 high finding │ ● [W007 high]: Insecure credential handling detected (high risk: 0.90). The │ skill explicitly requires reading "EVERY SOURCE FILE IN FULL," which forces │ the LLM to ingest any embedded credentials or secrets (e.g., .env, config │ files) into its context, creating a high risk of secret exposure even if not │ explicitly asked to output them. │ └── instruction SKILL.md ├── babysit 1 high finding │ ● [W011 high]: Third-party content exposure detected (high risk: 0.85). │ SKILL.md’s required workflow directs the agent to “Read new comments and │ unresolved review threads” from a GitHub PR, which will include │ outsider-authored free-form text (PR comments/review thread bodies) that the │ agent would ingest to decide what to do. │ └── instruction SKILL.md ├── timeline-report 1 high finding │ ● [W011 high]: Third-party content exposure detected (high risk: 0.75). This │ workflow calls the outsider-provided (non-operating-user-authored) │ claude-mem worker API endpoint `/api/context/inject?...&full=true`, whose │ response is “pre-formatted markdown” placed directly into the subagent │ prompt as `[TIMELINE CONTENT GOES HERE]`, so any free text stored from │ others’ contributions in the timeline can be injected into LLM context. │ └── instruction SKILL.md ├── version-bump │ ├── instruction SKILL.md │ └── script scripts/generate_changelog.js ├── standup │ ├── instruction SKILL.md │ ├── instruction agent-brief.md │ └── asset standup.mjs ├── how-it-works │ ├── instruction SKILL.md │ └── instruction onboarding-explainer.md ├── wowerpoint 2 findings (2 high) │ ● [E006 high]: Malicious code pattern detected (high risk: 0.90). The │ workflow intentionally uploads generated PDFs to an external WOWerpoint │ service (using an environment-provided upload token and curl), which │ constitutes high-risk data exfiltration of potentially sensitive documents │ if misused or set without user consent. │ ● [W011 high]: Third-party content exposure detected (high risk: 0.75). │ Outsider-authored free text can enter the LLM context via the user-supplied │ `` and the referenced ` ` source document, which are then │ ingested by the NotebookLM subagent when it runs `notebooklm source add │ " "` and `notebooklm generate slide-deck " "`; the skill │ explicitly allows passing user prompt “verbatim.” │ └── instruction SKILL.md ├── pathfinder │ └── instruction SKILL.md ├── oh-my-issues 1 high finding │ ● [W011 high]: Third-party content exposure detected (high risk: 0.85). │ Yes—SKILL.md’s “Read everything in full” workflow fetches full │ outsider-authored GitHub issue bodies and comment threads via `gh issue view │ --json comments`, and those comment/body texts would then be ingested │ into the agent’s LLM context for clustering/classification. │ └── instruction SKILL.md ├── smart-explore │ └── instruction SKILL.md ├── knowledge-agent │ └── instruction SKILL.md ├── do │ └── instruction SKILL.md ├── make-plan 1 medium finding │ ● [W011 medium]: Third-party content exposure detected (medium risk: 0.65). │ This skill’s required workflow is “Documentation Discovery” via subagents │ that search/read documentation (docs/URLs), which can include │ outsider-authored free text from public sources at runtime. │ └── instruction SKILL.md ├── mem-search │ └── instruction SKILL.md ├── design-is 1 high finding │ ● [W011 high]: Third-party content exposure detected (high risk: 0.70). │ SKILL.md requires the agent to gather “Visual Evidence” via `agent-browser` │ when the target is a reachable URL (public web content fetched at runtime), │ which can ingest outsider-authored free text into the LLM context through │ browser-extracted page content. │ └── instruction SKILL.md └── weekly-digests 1 high finding ● [W011 high]: Third-party content exposure detected (high risk: 0.90). Outsider-authored free text is ingested into the LLM via `curl` fetching a full timeline from a worker endpoint (`/api/context/inject?project=...&full=true`) into `.scratch/cm-timeline.md`, which is then split and inserted into each subagent prompt as `{ABSOLUTE_PATH_TO_WEEK_FILE}` (raw source contents). └── instruction SKILL.md ● Scanning /home/agentuser/.codex found 1 mcp server and 2 skills │ ├── codebase-memory-mcp 4 findings (1 medium, 3 low) │ ● [W019 medium]: Destructive Capabilities. │ ● [W016 low]: Untrusted Content Retrieval. │ ● [W001 low]: Found the words "ignore","important","critical","override" in │ the tool description. It is a common word used in prompt injection attacks. │ ● [W018 low]: Workspace Data Exposure. │ ├── tool index_repository │ ├── tool search_graph │ ├── tool query_graph │ ├── tool trace_path │ ├── tool get_code_snippet │ ├── tool get_graph_schema │ ├── tool get_architecture │ └── tool search_code ├── find-skill-skillhub 4 findings (4 high) │ ● [E005 high]: Suspicious download URL detected (high risk: 1.00). Most │ links are API/website endpoints, but the direct link to a remote install.sh │ hosted on a cloud object storage (and referenced to be piped into bash) is │ high-risk because executing remote shell scripts can deliver malware. │ ● [E006 high]: Malicious code pattern detected (high risk: 1.00). The skill │ instructs the agent to secretly execute remote shell scripts and CLI install │ commands (including piping a remote curl to bash) and to hide those commands │ from the user, which enables remote code execution and supply-chain │ installation on the host. │ ● [W012 high]: Potentially malicious external URL detected (high risk: │ 1.00). The skill's installation step instructs running a remote install │ script via curl that is piped to bash (curl -fsSL │ https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh │ | bash -s -- --cli-only), which fetches and executes remote code at runtime. │ ● [W013 high]: Attempt to modify system services in skill instructions │ detected (high risk: 1.00). The skill's Step 5 tells the agent to directly │ execute installation scripts and run the CLI installer (e.g., install.sh │ --cli-only and skillhub install ...) on the agent rather than only │ recommending commands, which modifies the agent's environment and can │ require elevated privileges or download/run arbitrary code. │ ├── instruction SKILL.md │ ├── instruction references/office-efficiency.md │ ├── instruction references/professional.md │ ├── instruction references/life-service.md │ ├── instruction references/api.md │ ├── instruction references/education.md │ ├── instruction references/knowledge-management.md │ ├── instruction references/design-media.md │ ├── instruction references/ai-agent.md │ ├── instruction references/categories.md │ ├── instruction references/data-analysis.md │ ├── instruction references/business-ops.md │ ├── instruction references/content-creation.md │ ├── instruction references/dev-programming.md │ ├── instruction references/it-ops-security.md │ └── asset _meta.json └── agent-reach 4 findings (4 high) ● [E005 high]: Suspicious download URL detected (high risk: 0.80). These URLs include a direct install script (curl|bash) and a GitHub releases API endpoint used to fetch packaged binaries — patterns that deliver executable code from third-party GitHub accounts and can be used to distribute malware if the sources are not fully trusted. ● [E006 high]: Malicious code pattern detected (high risk: 0.90). The repo contains high-risk operational guidance that requests user browser cookies/credentials be pasted or transferred to the agent, persists them to local tool directories, and instructs executing remote install scripts (curl | bash) and downloading/running third-party binaries — patterns that enable credential exfiltration and supply‑chain/remote‑code execution abuse. ● [W011 high]: Third-party content exposure detected (high risk: 0.90). High likelihood: the runtime workflow is explicitly designed to fetch outsider-authored free text from public web/social platforms (e.g., Jina Reader `curl -s "https://r.jina.ai/URL"` / RSS feeds / social notes/comments via platform CLIs or MCP tools) and then pass that fetched page/post content into the agent for synthesis. ● [W012 high]: Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit runtime install commands that fetch and execute remote code (curl | bash and git-based pipx install), e.g. https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh, https://api.github.com/repos/xpzouying/xiaohongshu-mcp/releases/latest, and git+https://github.com/public-clis/rdt-cli.git, which are downloaded and executed during setup. ├── instruction SKILL.md ├── instruction references/xiaohongshu-login.md ├── instruction references/channel-setup.md ├── instruction references/video.md ├── instruction references/complementary-tools.md ├── instruction references/web.md ├── instruction references/dev.md ├── instruction references/social.md ├── instruction references/career.md ├── instruction references/twitter-xurl.md ├── instruction references/xiaohongshu-login-issue.md └── instruction references/search.md CI (--ci): exiting with code 1 (issue codes: E005, E006, W001, W007, W011, W012, W013, W016, W017, W018, W019, W020, X002).
扫描完成