Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-17-hermes-agent-the-gap-in-that-trust-gate-a-git-pull-could-inject-a-skill-into-an
The gap in that trust gate -- a git pull could inject a skill into an already-trusted repo -- is fixed only on main.
The follow-up to #88566 names the hole its predecessor left: trust via hermes skills trust is a repo-level decision made once, but the repo's skill content changes with every pull -- the hub install path scans, a checkout did not, so a git pull could inject a malicious skill into an already-trusted repo with no scan anywhere. This PR runs every project SKILL.md dir through skills_guard.scan_skill_cached, the same scanner as hub installs, with the cache under ~/.hermes/cache/project_skill_scans/ and explicitly never inside the repo; a dangerous verdict quarantines and a scanner failure fails closed. iter_project_skill_files() becomes the single iteration chokepoint so no consumer can bypass the gate. It also makes non-interactive surfaces (cron, API, ACP) inherit the human's trust decision by project identity via TERMINAL_CWD rather than prompting or auto-trusting -- untrusted or no workdir loads nothing, and it never prompts. Tests include a real malicious fixture scoring dangerous on six findings including prompt_injection_ignore and hermes_env_access.
Channel: main-unreleased. Ancestry: merge_commit_sha 6e22d265835fe035e648f53b9f28d772037566f0, merged 2026-08-17T21:06:17Z into main. GET repos/NousResearch/hermes-agent/compare/6e22d265...v2026.8.16.2 -> status=behind, i.e. the newest stable tag is BEHIND this commit and does not contain it. The tag was created 2026-08-17T18:43:23Z, roughly 2h23m before the merge. No later tag exists as of 2026-08-17.
Operator consequence: This is the entry that matters for the publication's central rule. Project-local skills are in a stable tag; the scan that keeps a trusted repo trustworthy across pulls is not. If you turn on project skill discovery on v0.20.3, you are running the tier without its quarantine -- trust only repos you control, and re-check for a tag containing 6e22d265 before you widen that.
Receipt
Finding metadata
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
Finding ID: 2026-08-17-hermes-agent-the-gap-in-that-trust-gate-a-git-pull-could-inject-a-skill-into-an
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact