Files
hermes-agent/tests/tools
ClintonEmok e22b8b66ce fix(skills): stop agent-config persistence patterns from blocking meta-skills (#92021)
The skills-guard-v1 scanner flagged ANY mention of AGENTS.md / CLAUDE.md /
.cursorrules / .clinerules as critical/persistence. Any critical finding
forces a dangerous verdict, and community installs cannot be overridden
with --force — so legitimate meta-skills that merely DISCUSS agent config
files (authoring guides, setup docs, cross-references) were permanently
blocked. Three popular community skills were hit in the wild.

skills-guard-v2 scores the persistence category in three tiers:

- Mechanical persistence (shell redirection or sed -i targeting an agent
  config file) stays critical -> dangerous. An unambiguous write path.
- Modification language in imperative position (verb at line/bullet start
  within 80 chars of the filename) is high -> caution. Regexes cannot
  separate "Edit AGENTS.md to inject instructions" from descriptive prose,
  but imperative verbs are the shape real instructions take. Caution keeps
  the install confirmable instead of irreversibly blocked.
- Bare references drop to low/informational for auditability without
  driving the verdict.

The verb-proximity shape matches the existing convention in
tools/threat_patterns.py, and the tiering mirrors how allowed_tools_field
was already handled. The pattern id agent_config_mod is preserved so
plugin_guard.CODE_EXEMPT_PATTERN_IDS stays valid; hermes_config_mod /
other_agent_config get parallel _shell / _ref splits fixing the whole bug
class. SCANNER_VERSION bumps to v2 so cached v1 dangerous verdicts are
invalidated and re-scanned on next install attempt.
2026-08-28 03:24:43 -07:00
..
2026-08-18 20:03:18 -07:00