Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix Restricted skills can be listed or loaded by unauthorized gateway identities [1 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Hermes has gateway access-control needs for owner-only skills, but skill discovery/loading paths need to enforce the same sender restrictions consistently. Without filtering, an unauthorized gateway sender can discover restricted skills through skills_list, directly request them with skill_view, or see slash/preload skill commands built from shared skill discovery.

Root Cause

Hermes has gateway access-control needs for owner-only skills, but skill discovery/loading paths need to enforce the same sender restrictions consistently. Without filtering, an unauthorized gateway sender can discover restricted skills through skills_list, directly request them with skill_view, or see slash/preload skill commands built from shared skill discovery.

Fix Action

Fixed

RAW_BUFFERClick to expand / collapse

Title: Restricted skills can be listed or loaded by unauthorized gateway identities

Summary

Hermes has gateway access-control needs for owner-only skills, but skill discovery/loading paths need to enforce the same sender restrictions consistently. Without filtering, an unauthorized gateway sender can discover restricted skills through skills_list, directly request them with skill_view, or see slash/preload skill commands built from shared skill discovery.

Impact

Skills often encode private operational workflows and service access details. Owner-only skills such as home automation, Sonarr/Radarr, or deployment workflows should not be discoverable or loadable from non-owner messaging identities.

Expected behavior

For live gateway messages from unauthorized identities:

  • skills_list should omit restricted skills;
  • skill_view should reject restricted skills;
  • slash/preload skill command discovery should not expose restricted skill commands.

CLI/local/internal contexts should remain unaffected.

Suggested fix

Centralize a restricted-skill access check based on gateway session identity and skills.access_control.restricted_skills, then use it in tools/skills_tool.py and agent/skill_commands.py.

Regression tests

Add tests for unauthorized and authorized gateway identities across both tool-based skill loading and skill command discovery.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

For live gateway messages from unauthorized identities:

  • skills_list should omit restricted skills;
  • skill_view should reject restricted skills;
  • slash/preload skill command discovery should not expose restricted skill commands.

CLI/local/internal contexts should remain unaffected.

#database connection#vector store#embedding generation#cache error#pipeline error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix Restricted skills can be listed or loaded by unauthorized gateway identities [1 pull requests]