Hermes Attestation Guardian
Generate verifiable Hermes security attestations and detect authenticated baseline drift.
The material shows signed-feed and release verification, a pinned key, checksums, scoped paths, fail-closed checks, explicit advisory confirmation, and limited managed-schedule mutation; it also states that destructive remediation is absent. However, remote feed endpoint allowlisting is explicitly unimplemented, an unsafe unsigned bypass exists, data-flow and trust-boundary decisions remain operator-dependent, and publisher identity is unverified, so points are deducted.
The code and documentation are broadly consistent about Hermes-only scope, Node requirements, fail-closed behavior, path confinement, and diagnostic errors. Static review provides no execution, committed test files, or reproducible runtime evidence in the supplied material, and documented/package version constants are inconsistent, so the score remains below the static ceiling.
The target platform, commands, and non-fit boundary are clear. The skill is Hermes-only, provides no Chinese-language support evidence, defaults to a remote service whose mainland-China reachability is unverified, and does not fully specify semantic trigger boundaries, so points are deducted.
The skill includes frontmatter, installation guidance, runtime requirements, commands, side-effect disclosures, limitations, and a substantial changelog. Maintenance ownership, update path, parameter stability, and FAQ coverage are incomplete, and the supplied material does not directly include the license file, so points are deducted.
The stated goals and code cover attestation generation, verification, baseline drift comparison, and advisory gating with directly described output locations. Because nothing was executed and no actual outputs or end-to-end evidence were supplied, correctness, completeness, and marginal benefit over manual alternatives remain only partially supported; the score is capped by static calibration.
The supplied source is auditable for hashing, signatures, schema checks, path confinement, and drift comparison. Tests are only referenced by README/changelog claims; test files and third-party execution evidence are absent, limiting independent reproducibility and corroboration.
- Do not enable --allow-unsigned by default or leave that bypass in scheduled jobs.
- Remote advisory-feed URL allowlisting is not implemented; independently validate endpoint trust and mainland-China reachability before deployment.
- Before installation, verify the release signature, pinned key fingerprint, and archive checksums, and reconcile documentation and code version inconsistencies.
What does this skill do, and when should you use it?
Hermes Attestation Guardian is a runtime security skill for operator-managed Hermes CLI, Gateway, and profile deployments. It generates deterministic posture attestations, verifies canonical digests, file integrity, and optional detached signatures, and compares authenticated baselines for drift. It also verifies signed advisory feeds and provides an advisory-aware skill verification gate requiring explicit confirmation for matches. It is not an OpenClaw runtime hook package.
Runs Node.js scripts to generate JSON attestations under $HERMES_HOME/security/attestations, with an optional SHA-256 sidecar; reads policy files, host metadata, Hermes runtime posture, advisory-feed verification state, watched files, and trust anchors; verifies schema, canonical digest, configured file hashes, optional detached signatures, and authenticated baselines; refreshes and checks signed advisory caches; gates skill verification against affected names and version ranges; and previews or applies user-level scheduler configuration.
- Hermes operators need recurring, auditable JSON records of runtime security posture.
- Security teams need to compare current Hermes state with an authenticated baseline and fail on high or critical drift.
- Platform administrators installing community skills need to verify signed release manifests, archives, and metadata before trusting them.
- Incident responders need to verify advisory-feed signatures and require explicit operator acknowledgement when a skill matches an advisory.
- Hermes administrators need scheduled attestation or advisory checks while limiting edits to the skill's managed user-schedule blocks.
What are this skill's strengths and limitations?
- Hermes-specific deterministic attestations with canonical digest and baseline drift verification.
- Supports signed advisory feeds, file hashes, trust anchors, and optional detached signatures.
- Uses fail-closed behavior for key verification failures and configurable severity gates.
- Scheduler application rewrites only explicitly delimited managed blocks for the current user.
- Strictly limited to Hermes infrastructure and not an OpenClaw runtime hook package.
- Requires Node.js plus command-line tools including curl, OpenSSL, and jq.
- Remote advisory URL allowlisting is not implemented in v0.0.2, so operators must explicitly trust configured feed and checksum endpoints.
- Advisory version matching does not support OR or hyphen ranges; --allow-unsigned is emergency-only and weakens verification.
- Does not implement destructive remediation such as deletion, restoration, or quarantine.
How do you install this skill?
Install with the Vercel Skills CLI:
npx skills add prompt-security/clawsec --skill hermes-attestation-guardian -a hermes-agent -y
For standalone installation, first follow the verification script in SKILL.md to validate the signed release manifest, archive, SKILL.md, and skill.json. Install or extract the archive only after verification succeeds. The source does not document another installation directory or manual-copy procedure.
How do you use this skill?
Generate an attestation:
node scripts/generate_attestation.mjs
Verify the current attestation:
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json
Check drift against an authenticated baseline:
node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json --baseline ~/.hermes/security/attestations/baseline.json --baseline-expected-sha256 <trusted-baseline-sha256> --fail-on-severity high
Run the commands from the skill directory containing scripts/. Scheduler commands preview by default; use --apply to modify the managed schedule block.
How does this skill compare with similar options?
Compared with the broader ClawSec suite described in the README, this skill focuses only on Hermes attestations, advisory verification, and drift detection rather than capabilities provided by sibling platform skills. Unlike the OpenClaw, NanoClaw, and Picoclaw skills, it is not intended to operate as their runtime security component.