fix(security): keep Hermes secrets out of env passthrough#3948
Conversation
|
Nice catch on the env passthrough. I've been working on credential file protection in #2714 (read-path deny list). Worth checking that the secret patterns blocked here in env passthrough align with the credential file deny list — both approaches should share the same definition of what counts as a 'secret' to avoid gaps. |
|
One of my agent's skills does exactly that. required_environment_variables OPENROUTER_API_KEY to curl for credits remaining. Is there a mechanic panned to unblock this block? What do we do for skills that need hermes' secrets? |
|
Closing — the underlying config.yaml passthrough bypass you identified IS real, but it just landed via #27794 (3ab7e2a on main) using the narrower approach of reusing the existing Your PR refactors the blocklist into a new module that's then imported by env_passthrough + environments/local. That's a reasonable architectural shape, but on top of the existing usage we'd end up touching every importer to switch sources — net churn for the same security guarantee. The narrower #27794 path closes the gap without moving the source of truth. Thanks for flagging the skill-side + config-side passthrough asymmetry — that framing is what drove the narrow fix. |
What does this PR do?
Fixes a sandbox secret-filter bypass in skill and config env passthrough.
Hermes strips provider API keys, gateway tokens, and tool credentials from
terminal/execute_codechild environments by default. However, a skill could declare one of those Hermes-managed secrets inrequired_environment_variables, or a user could list it interminal.env_passthrough, and the passthrough registry would re-allow it.That meant loading a third-party skill that declared something like
OPENAI_API_KEYcould silently punch Hermes-managed secrets back into sandboxed child processes.This change keeps Hermes-managed secrets blocked even when a skill or config entry tries to pass them through, and updates the docs to match the enforced behavior.
Type of Change
Changes Made
terminal.env_passthroughHow to Test
source .venv/bin/activatepython -m pytest tests/tools/test_env_passthrough.py tests/tools/test_skill_env_passthrough.py tests/tools/test_local_env_blocklist.py tests/tools/test_skills_tool.py -qrequired_environment_variables: [OPENAI_API_KEY, TENOR_API_KEY]OPENAI_API_KEYis not registered/passed through, whileTENOR_API_KEYstill isOPENAI_API_KEYtoterminal.env_passthroughand confirm it is ignoredValidation
python -m pytest tests/tools/test_env_passthrough.py tests/tools/test_skill_env_passthrough.py tests/tools/test_local_env_blocklist.py tests/tools/test_skills_tool.py -q→117 passedOPENAI_API_KEYcausedis_env_passthrough("OPENAI_API_KEY") == Trueand_sanitize_subprocess_env(...)kept the secretOPENAI_API_KEYstays blocked while normal skill-specific keys likeTENOR_API_KEYstill pass through