Skills Guard Multi-Word Prompt Injection Bypass

fix_security___catch_multi_word_prompt_injection_in_skills_g-4ea29978-Multi-Word-Bypass-Exploit-TP-ISSUE-REPORT.md

Advisory Details

Title: Skills Guard Multi-Word Prompt Injection Bypass

Description:

Summary

A prompt injection vulnerability exists in the skills_guard.py component allowing attackers to evade detection patterns by inserting extra words. This allows attackers to bypass the "Critical" severity filters (such as system prompt override) and potentially install malicious skills into the workspace that modify the agent's core behaviors.

Details

The security patch 4ea29978 hardened some multi-word prompt injection patterns in skills_guard.py (THREAT_PATTERNS) to use flexible whitespace and word matching like (?:\w+\s+)*. For example:

(r'ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+instructions',

However, two other injection patterns in the same file were omitted during the update and remain rigid:

(r'system\s+prompt\s+override',     # severity: CRITICAL
(r'new\s+policy',                   # severity: medium

An attacker can easily bypass these filters by injecting extraneous words between the critical keywords. For example, injecting system prompt temporary override instead of system prompt override. The Python re module will fail to match the rigid pattern.

PoC

Prerequisites

• The feature allowing community skills installation is enabled or a user passes an untrusted skill definition to the skills_guard.py mechanism.

Reproduction Steps

IMPORTANT: The script required for the PoC has been uploaded as a secret GitHub Gist. Reference the Gist URL so that developers can download and run the scripts directly. The corresponding PoC files are available in the fix_security___catch_multi_word_prompt_injection_in_skills_g-4ea29978-Multi-Word-Bypass-Variant-exp folder under the same directory as this report. Furthermore, ensure the PoC scripts are as minimal and concise as possible.

1. Download the PoC exploit script from: poc_exploit.py

2. Run the command to test the regular expression matching against standard and obfuscated payloads.

   python poc_exploit.py

3. Observe that the blocked-skill payload triggers the error from skills_guard.py, but the bypass-skill payload with an extra word (system prompt temporary override) achieves a successful install without being flagged.

Log of Evidence

=== TEST 1: Blocked ===
Result: {'error': "Skill blocked. Contains malicious prompt injection pattern: ['system prompt override']"}
Skill blocked. Contains malicious prompt injection pattern: ['system prompt override']

=== TEST 2: Bypass ===
Result: {'success': True, 'msg': 'Skill bypass-skill created.'}
[SUCCESS] Regex bypass successfully created malicious skill!

Impact

This vulnerability represents an Injection bypass allowing for unauthorized manipulation of the AI agent's execution logic. Specifically, the attacker bypasses a Critical severity check, potentially allowing a malicious skill to be installed without quarantine. Once installed, these skills are loaded into the system prompt on all future sessions and can instruct the agent to execute malicious actions or override policies without the user's knowledge.

Affected products

• Ecosystem: Python
• Package name: hermes-agent
• Affected versions: <= v2026.4.23
• Patched versions:

Severity

• Severity: Critical
• Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

• CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

Permalink	Description
https://github.com/NousResearch/hermes-agent/blob/50d86b3c71f274ed6ff489cdb68a7393377f3d1c/agent/skills_guard.py#L169	The rigid system\s+prompt\s+override pattern vulnerable to extra-word bypasses.
https://github.com/NousResearch/hermes-agent/blob/50d86b3c71f274ed6ff489cdb68a7393377f3d1c/agent/skills_guard.py#L473	The rigid new\s+policy pattern vulnerable to extra-word bypasses.