hermes - 💡(How to fix) Fix security: env_passthrough could allow malicious skills to leak API keys to subprocesses

Summary

tools/env_passthrough.py allows specific environment variables to be whitelisted into sandboxed subprocesses (execute_code, terminal). A malicious skill or compromised user config could whitelist credential variables (e.g., OPENAI_API_KEY, GH_TOKEN) and leak them to untrusted code.

Details

Skills declare required_environment_variables in their frontmatter, and users can add overrides via terminal.env_passthrough in config.yaml. Both feed into is_env_passthrough(), which is consulted before stripping secrets from the child environment.

Impact

• Malicious skill whitelists OPENAI_API_KEY → untrusted code receives the key
• Compromised config adds GH_TOKEN to passthrough → GitHub token leaked to subprocess

Recommendation

1. Never allow passthrough for credential variables (anything in _HERMES_PROVIDER_ENV_BLOCKLIST) unless the user explicitly approves per-session
2. Audit and log every passthrough decision with the variable name and the requesting skill/config source
3. Add a UI confirmation when a skill requests passthrough for a variable that matches a known credential pattern

Files

• tools/env_passthrough.py
• tools/code_execution_tool.py
• tools/environments/local.py

Severity: MEDIUM