hermes - 💡(How to fix) Fix security: terminal command approval guards can be bypassed with shell obfuscation [1 pull requests]

Summary

The tools/approval.py module uses regex blocklists (HARDLINE_PATTERNS, DANGEROUS_PATTERNS) to detect dangerous shell commands. These regex guards are inherently fragile and can be bypassed with standard shell obfuscation techniques.

Bypass Techniques

1. Base64 encoding: echo cm0gLXJmIC8= | base64 -d | bash
2. Command substitution: $(echo rm -rf /) or backticks
3. Env var expansion: /$HOME/.ssh instead of /home/user/.ssh
4. Alias trickery: alias ls=rm; ls -rf /
5. Unicode homoglyphs: using lookalike characters
6. force=True parameter: completely skips all guards when a tool call includes this internal flag.

Impact

An attacker (via prompt injection or a compromised skill) could execute destructive commands (rm -rf, credential exfiltration, reverse shells) that bypass the approval system entirely.

Recommendation

Replace regex blocklists with an allowlist of safe commands/arguments. The force=True parameter should require a cryptographic user confirmation (e.g., a signed token or a TOTP challenge), not just a boolean flag. Consider moving all untrusted command execution to a restricted shell or containerized backend by default.

Files

• tools/approval.py
• tools/terminal_tool.py (force parameter)

Severity: HIGH