扫描时间: Wed Jul 29 01:27:31 AM CST 2026 | 范围: ~/.hermes/skills/ ~/.claude/ ~/.codex/
Snyk Agent Scan v0.5.15
--dangerously-run-mcp-servers is set: starting every stdio MCP server listed in
the scanned configs without prompting.
Tip: set --suppress-mcpserver-io=true to hide server stderr output.
[codebase-memory-mcp] level=info msg=mem.init budget_mb=930 total_ram_mb=3723
[codebase-memory-mcp] level=info msg=server.start version=0.9.0
[codebase-memory-mcp] level=info msg=watcher.start interval_ms=multi-sec
[codebase-memory-mcp] level=info msg=session.root.cwd
path=/home/agentuser/.hermes/scripts
[codebase-memory-mcp] level=info msg=autoindex.skip reason=disabled
hint=run:_codebase-memory-mcp_config_set_auto_index_true
[codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc
method=initialize status=ok duration_ms=1
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=prompts/list status=error duration_ms=0
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=resources/list status=error duration_ms=0
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=resources/templates/list status=error duration_ms=0
[codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc
method=tools/list status=ok duration_ms=0
[codebase-memory-mcp] level=info msg=server.shutdown
[codebase-memory-mcp] level=info msg=watcher.stop
[codebase-memory-mcp] level=info msg=mem.init budget_mb=930 total_ram_mb=3723
[codebase-memory-mcp] level=info msg=server.start version=0.9.0
[codebase-memory-mcp] level=info msg=watcher.start interval_ms=multi-sec
[codebase-memory-mcp] level=info msg=session.root.cwd
path=/home/agentuser/.hermes/scripts
[codebase-memory-mcp] level=info msg=autoindex.skip reason=disabled
hint=run:_codebase-memory-mcp_config_set_auto_index_true
[codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc
method=initialize status=ok duration_ms=0
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=prompts/list status=error duration_ms=0
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=resources/list status=error duration_ms=0
[codebase-memory-mcp] level=warn msg=mcp.request protocol=jsonrpc
method=resources/templates/list status=error duration_ms=0
[codebase-memory-mcp] level=info msg=mcp.request protocol=jsonrpc
method=tools/list status=ok duration_ms=0
[codebase-memory-mcp] level=info msg=server.shutdown
[codebase-memory-mcp] level=info msg=watcher.stop
● Scanning /home/agentuser/.claude found 1 mcp server
│
└── codebase-memory-mcp 4 findings (1 medium, 3 low)
● [W019 medium]: Destructive Capabilities.
● [W016 low]: Untrusted Content Retrieval.
● [W001 low]: Found the words "override","important","ignore","critical" in
the tool description. It is a common word used in prompt injection attacks.
● [W018 low]: Workspace Data Exposure.
├── tool index_repository
├── tool search_graph
├── tool query_graph
├── tool trace_path
├── tool get_code_snippet
├── tool get_graph_schema
├── tool get_architecture
└── tool search_code
● Scanning /home/agentuser/.codex found 1 mcp server and 2 skills
│
├── codebase-memory-mcp 4 findings (1 medium, 3 low)
│ ● [W019 medium]: Destructive Capabilities.
│ ● [W016 low]: Untrusted Content Retrieval.
│ ● [W001 low]: Found the words "override","important","ignore","critical" in
│ the tool description. It is a common word used in prompt injection attacks.
│ ● [W018 low]: Workspace Data Exposure.
│ ├── tool index_repository
│ ├── tool search_graph
│ ├── tool query_graph
│ ├── tool trace_path
│ ├── tool get_code_snippet
│ ├── tool get_graph_schema
│ ├── tool get_architecture
│ └── tool search_code
├── find-skill-skillhub 3 findings (2 high, 1 medium)
│ ● [E005 high]: Suspicious download URL detected (high risk: 1.00). One URL
│ is a direct link to an install.sh hosted on a personal Tencent COS bucket
│ and is recommended to be piped to bash (curl | bash), which is a high‑risk
│ vector for distributing malware.
│ ● [W012 high]: Potentially malicious external URL detected (high risk:
│ 1.00). The skill's installation instructions include a runtime command that
│ downloads and pipes a remote shell script to bash —
│ https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh
│ — which executes remote code during installation.
│ ● [W011 medium]: Third-party content exposure detected (medium risk: 0.30).
│ Skill.md 的运行时流程在 Step 2 通过用户自然语言提取关键词后调用公开接口 `GET
│ https://api.skillhub.cn/api/skills?keyword=..`
│ 读取并再用于意图匹配/推荐（属于外部提交的自由文本可进入后续检索与内容选择链
│ 路），但文本本身主要是被当作检索词而非直接直接消费任意条目内容。
│ ├── instruction SKILL.md
│ ├── instruction references/office-efficiency.md
│ ├── instruction references/professional.md
│ ├── instruction references/life-service.md
│ ├── instruction references/api.md
│ ├── instruction references/education.md
│ ├── instruction references/knowledge-management.md
│ ├── instruction references/design-media.md
│ ├── instruction references/ai-agent.md
│ ├── instruction references/categories.md
│ ├── instruction references/data-analysis.md
│ ├── instruction references/business-ops.md
│ ├── instruction references/content-creation.md
│ ├── instruction references/dev-programming.md
│ ├── instruction references/it-ops-security.md
│ └── asset _meta.json
└── agent-reach 4 findings (3 high, 1 medium)
● [E005 high]: Suspicious download URL detected (high risk: 0.70). These
URLs include a raw GitHub install script (curl|bash) and a GitHub releases
API endpoint for a likely personal/third‑party repo (xpzouying) — both
high‑risk patterns for distributing unreviewed binaries or installers.
● [E006 high]: Malicious code pattern detected (high risk: 0.90). The repo
contains high-risk operational guidance that requests user browser
cookies/credentials be pasted or transferred to the agent, persists them to
local tool directories, and instructs executing remote install scripts (curl
| bash) and downloading/running third-party binaries — patterns that enable
credential exfiltration and supply‑chain/remote‑code execution abuse.
● [W012 high]: Potentially malicious external URL detected (high risk:
0.90). The skill contains explicit runtime install commands that fetch and
execute remote code (curl | bash and git-based pipx install), e.g.
https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh,
https://api.github.com/repos/xpzouying/xiaohongshu-mcp/releases/latest, and
git+https://github.com/public-clis/rdt-cli.git, which are downloaded and
executed during setup.
● [W011 medium]: Third-party content exposure detected (medium risk: 0.30).
agent-reach’s required runtime workflow can read outsider-authored free text
from social/community platforms at runtime (e.g., via
opencli/rdt-cli/desktop browsers for Reddit and OpenCLI for
Twitter/X/Reddit/XiaohongShu/Bilibili), where the LLM ingests post/comment
contents returned by those platform tools.
├── instruction SKILL.md
├── instruction references/xiaohongshu-login.md
├── instruction references/channel-setup.md
├── instruction references/video.md
├── instruction references/complementary-tools.md
├── instruction references/web.md
├── instruction references/dev.md
├── instruction references/social.md
├── instruction references/career.md
├── instruction references/twitter-xurl.md
├── instruction references/xiaohongshu-login-issue.md
└── instruction references/search.md
CI (--ci): exiting with code 1 (issue codes: E005, E006, W001, W011, W012, W016,
W018, W019).
扫描完成 — 发现问题（见上方详情）