Hermos Ide

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution. can delete files.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  src/app/api/git/status/route.ts, line 11

  export const runtime = "nodejs"; // required for child_process.execFile

  src/lib/checkpoints.test.ts, line 40

  await fs.rm(tmpDir, { recursive: true, force: true });

  src/lib/checkpoints.test.ts, line 142

  await fs.rm(tmpDir, { recursive: true, force: true });

  Show more

  src/lib/checkpoints.test.ts, line 182

  await fs.rm(fenced, { recursive: true, force: true }).catch(() => {});

  src/lib/checkpoints.test.ts, line 216

  await fs.rm(otherRoot, { recursive: true, force: true }).catch(() => {});

  src/lib/checkpoints.ts, line 225

  await fs.unlink(src).catch(() => {});

  src/lib/checkpoints.ts, line 444

  await fs.unlink(newFilePath);

  src/lib/checkpoints.ts, line 461

  await fs.rm(newDirPath, { recursive: true, force: true });

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  package.json, line 25

  postinstall

  azure-pipelines.yml, line 37

  curl -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal

  azure-pipelines.yml, line 149

  curl -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal

  Show more

  azure-pipelines.yml, line 219

  curl -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  scripts/ensure-extra-prisma-engines.mjs, line 69

  const resp = await fetch(url);

  scripts/provision-node-sidecar.mjs, line 79

  * Download a dist tarball via curl (argv array), verify its sha256 against

  scripts/release-to-github.mjs, line 42

  const res = await fetch(API + urlPath, {

  Show more

  scripts/release-to-github.mjs, line 279

  const res = await fetch(url, {

  scripts/release-to-github.mjs, line 305

  const res = await fetch(url, {

  scripts/release-to-github.mjs, line 402

  * - Authenticated `.sig` fetch (avoids rate-limit / private-repo failures).

  scripts/release-to-github.mjs, line 431

  const sigRes = await fetch(asset.browser_download_url, {

  scripts/release-to-github.mjs, line 488

  const res = await fetch(uploadUrl, {

  src/app/api/browser/proxy/route.ts, line 283

  res = await fetch(current, {

  src/lib/open-external.ts, line 32

  const res = await fetch("/api/system/open-url", {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  next.config.ts, line 28

  // dev repo's .env via Prisma's dotenv loader). Marking these external forces

  next.config.ts, line 61

  ".env*",

  scripts/nextjs-build.mjs, line 36

  // can trace the dev machine's real `.env` (DATABASE_URL, ENCRYPTION_KEY) into

  Show more

  scripts/nextjs-build.mjs, line 46

  for (const name of [".env", ".env.local", ".env.production", ".env.production.local"]) {

  scripts/nextjs-build.mjs, line 76

  // secret-leak class as the .env prune.

  scripts/nextjs-build.mjs, line 128

  // [fix: make standalone portable - never load the build machine's .env]

  scripts/nextjs-build.mjs, line 132

  // real `.env` (DATABASE_URL → dev DB, ENCRYPTION_KEY → dev key) into every

  scripts/nextjs-build.mjs, line 134

  // against its own directory (where `.env` is pruned), so runtime env comes

  scripts/release-to-github.mjs, line 11

  const TOKEN = process.env.GITHUB_TOKEN;

  src/app/api/health/route.ts, line 10

  const token = process.env.HERMOS_INSTANCE_TOKEN;

  src/lib/encryption.ts, line 13

  const k = process.env.ENCRYPTION_KEY;

  src/lib/security-stress.test.ts, line 259

  process.env.ENCRYPTION_KEY = "

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  package-lock.json, line 1

  {

  src/lib/workspace.safe-path.adversarial.test.ts, line 1

  /**

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit f6dd0df6b028. requests shell access. No manifest field names shell or command execution. can delete files. install fetches a script from the network. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen