registry / hermes-to-claude / 0.1.0

hermes-to-claude@0.1.0

Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installation silently changes the user-wide Claude Code statusLine setting to execute this package's statusline program. That program executes a command preserved from the previous Claude setting on future statusline renders.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs postinstall; later Claude Code statusline execution

Impact

persistent user-wide AI-agent control-surface mutation and execution through Claude Code

Mechanism

postinstall Claude Code config takeover and deferred shell execution

Policy narrative

The postinstall script reads ~/.claude/settings.json, saves any existing statusLine command to ~/.hbridge_user_statusline_cmd, and replaces the Claude Code statusLine command with `node dist/statusline.mjs`. On later statusline rendering, that package program reads the saved command and runs it with execSync. This is an unconsented install-time mutation of a foreign, user-wide AI-agent control surface with persistent deferred execution.

Rationale

Source inspection confirms concrete postinstall mutation of Claude Code configuration and deferred command execution. This meets the firewall block boundary despite no evidence of network exfiltration.

Evidence

package.jsonscripts/setup-mcp.cjsdist/statusline.mjs~/.claude/settings.json~/.hbridge_user_statusline_cmd

Network endpoints1

127.0.0.1

hermes-to-claude@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code