fix(skills_guard): agent-created dangerous skills return ask instead of block - #2271
Closed
redhelix wants to merge 11 commits into
Closed
fix(skills_guard): agent-created dangerous skills return ask instead of block#2271redhelix wants to merge 11 commits into
redhelix wants to merge 11 commits into
Conversation
added 11 commits
March 18, 2026 13:39
Implement webhook receiver for Mission Control integration: - Port: 8888 (configurable via MC_WEBHOOK_PORT) - Storage: SQLite (mission_control.db) - Notifications: CLI with ANSI colors - Auto-accept: Tasks assigned to hermes-cli automatically accepted Components: - adapter.py: Main aiohttp webhook server - database.py: SQLite operations for tasks, agents, deliveries - signature.py: HMAC-SHA256 verification - notifications.py: CLI notification handler - task_manager.py: Business logic for task lifecycle Environment variables: - MC_WEBHOOK_PORT, MC_WEBHOOK_SECRET, MC_WEBHOOK_PATH - MC_DB_PATH, MC_AGENT_NAME, MC_AUTO_ACCEPT Integration tests pass for: - Signature verification (valid/invalid/dev mode) - Task creation with auto-accept - Status change handling - Idempotency (duplicate event detection) - Event ID generation
Critical Security Fixes: - SQL injection protection: Added ALLOWED_COLUMNS whitelist in update_task() - Dev mode protection: Require MC_ALLOW_UNAUTHENTICATED=true to disable auth Code Quality Fixes: - Removed unused asyncio import - Added MAX_REQUEST_BODY_SIZE (1MB) to prevent memory exhaustion - Added request body size check in webhook handler All changes tested and verified.
- Add MC_WEBHOOK_HOST env var for configurable bind address - Add Mission Control to _apply_env_overrides() for auto-enable This allows the adapter to bind to 0.0.0.0 for external webhooks while maintaining backward compatibility with localhost-only.
Add unit tests for: - Signature verification (HMAC-SHA256, dev mode, timing attacks) - Database operations (CRUD, SQL injection protection, idempotency) - Task manager (event handling, auto-accept, status changes) - Adapter (routing, health checks, config loading) Test coverage includes: - Security: Signature validation, SQL injection prevention - Functionality: Task lifecycle, event routing, notifications - Edge cases: Empty bodies, unicode, missing data All tests use temporary databases and mocked dependencies for isolation and speed.
Add handlers for 20+ event types per Mission Control event-bus.ts: - Task events: task.* + activity.task_* (both formats) - Agent events: agent.* (created, updated, deleted, synced, status_changed) - Chat events: chat.message, chat.message.deleted - Notifications: notification.created, notification.read - Activity: activity.created - Security: audit.security, security.event - Connections: connection.created, connection.disconnected - GitHub: github.synced - Test: test.ping All events verified with HMAC-SHA256 signature validation. Returns 200 OK immediately after processing.
Add complete test suite covering all 20+ event types: Test Files Added: - test_adapter_full.py: 50+ tests for all event handlers - test_integration.py: 10 integration tests with real HTTP - conftest.py: Shared fixtures and utilities Coverage: - Task events: created, updated, status_changed, deleted (both prefixes) - Agent events: created, updated, deleted, synced, status_changed - Chat events: message, message.deleted - Notifications: created, read - Activity: created - Security: audit.security, security.event - Connections: created, disconnected - GitHub: synced - Test: ping Integration Tests: - Full webhook flow with task creation - Invalid signature rejection - Missing signature rejection - Duplicate event handling - Invalid JSON handling - Payload size limits - Health endpoint - All event types verification All tests use proper mocking for isolation while maintaining real HTTP testing for critical paths. Total: 60+ new test cases, ~700 lines of test code
…nto feature/mission-control-adapter
- Add mc_token_reporter.py module for reporting LLM token usage to Mission Control - Integrate token reporting into run_conversation() after each LLM API call - Add background heartbeat thread (60s interval) to keep agent online in MC - Support both sync and async (fire-and-forget) reporting modes - Automatic retry with exponential backoff (1s, 2s, 4s) for resilience - Graceful degradation - failures don't block the agent or affect user experience - Extract usage from both OpenAI and Anthropic response formats - Configuration via MISSION_CONTROL_URL, MISSION_CONTROL_API_KEY, MC_AGENT_NAME env vars
…nto feature/mission-control-adapter
…of block - Change INSTALL_POLICY for agent-created dangerous from 'block' to 'ask' - Fix should_allow_install: move force check before ask decision - Fix format_scan_report: show NEEDS CONFIRMATION for None (ask) case - Update tests to expect None (ask) instead of False (block) for dangerous agent-created
teknium1
added a commit
that referenced
this pull request
Mar 22, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR #2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
Contributor
|
Merged the skills_guard fix via PR #2446 (3 files, 26 lines). The Mission Control adapter (~3200 lines) was excluded as unrelated scope — please submit that as a separate PR if you'd like it reviewed. Thanks! |
outsourc-e
pushed a commit
to outsourc-e/hermes-agent
that referenced
this pull request
Mar 26, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
angelburgosrosado
pushed a commit
to angelburgosrosado/hermes-agent
that referenced
this pull request
Apr 27, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
02356abc
pushed a commit
to 02356abc/hermes-agent
that referenced
this pull request
May 14, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
gweeteve
pushed a commit
to gweeteve/hermes-agent
that referenced
this pull request
Jun 2, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
melon-xf
added a commit
to melon-xf/hermes-agent
that referenced
this pull request
Sep 3, 2026
Changes the policy for agent-created skills with critical security findings from 'block' (silently rejected) to 'ask' (allowed with warning logged). The agent created the skill, so blocking it entirely is too aggressive — let it through but log the findings. - Policy: agent-created dangerous changed from block to ask - should_allow_install returns None for 'ask' (vs True/False) - format_scan_report shows 'NEEDS CONFIRMATION' for ask - skill_manager_tool.py caller handles None (allows with warning) - force=True still overrides as before Based on PR NousResearch#2271 by redhelix (closed — 3200 lines of unrelated Mission Control code excluded).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes agent-created dangerous skills from 'block' to 'ask' behavior:
Behavior Change
This allows users to review and confirm agent-created skills with critical findings before they're installed, rather than automatic blocking.