dsh-hermes-security-audit
免费的 Linux 服务器安全审计——无需 API 密钥，也无需付费工具。扫描病毒（ClamAV）、Rootkit（rkhunter + chkrootkit）、SSH 暴力破解、加密货币挖矿程序、暴露的凭据和开放端口。1
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:axelfreeman/hermes-security-audit#36920e274e7650ea03a7c3439144380b261de176Hermes Security Audit 以 dsh-hermes-security-audit 发布，当前版本为 1.0.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →⭐ Star this repo to help more people audit their AI agents for malware.
12 detection methods. 5 minutes to run. Open source.
Check your Hermes agent for malware, rootkits, crypto miners, and SSH brute force attacks.
A security audit skill for Hermes Agent — an open-source AI assistant by Nous Research. If you run Hermes Agent on your own Linux server, this skill scans it for viruses, rootkits, backdoors, and other threats.
Think of it as antivirus for AI agents. Just like you scan your laptop, you should scan the server where your AI agent lives.
Hermes Agent runs on Linux servers with root access, Docker containers, API keys, and open network ports. That's a lot of attack surface. This Hermes agent vulnerability scanner checks:
| Threat | Detection Method |
|---|---|
| 🦠 Viruses & malware | ClamAV — industry-standard antivirus |
| 👻 Rootkits & backdoors | rkhunter + chkrootkit — dual rootkit detection |
| ⛏️ Crypto miners | Process audit — signature + behavioral analysis |
| 🔑 Exposed credentials | File scan — API keys, tokens, private keys in plain sight |
| 🚪 Open doors | Port audit — unnecessary services (CUPS, SMTP, printing) |
| 🤖 SSH brute force | Log analysis — 11,000+ failed attempts found and blocked |
| 🐳 Docker escapes | Container audit — privileged mode, exposed ports |
| 📅 Hidden cron jobs | Cron audit — all users, all schedules |
| 📁 SUID/SGID exploits | Privilege escalation vector detection |
| 🌐 Outbound connections | Network connection audit — who's calling home |
# 1. Install Hermes Agent (if not already)
# https://github.com/nous-research/hermes-agent
# 2. Load the security skill
hermes skill load hermes-security-audit
# 3. Run the audit
# Say to your Hermes agent: "run a security audit on my server"
Or just copy the SKILL.md into ~/.hermes/profiles/your_profile/skills/.
Detects hidden services listening on unexpected ports. Finding: CUPS print service on port 631, SMTP on port 25, Zabbix agent on 10050 — all unnecessary, all removed.
Scans for crypto miners (xmrig, stratum), suspicious process names mimicking legitimate ones, and orphaned services. Finding: orphaned Xray SOCKS5 proxy from previous testing — killed.
Counts failed authentication attempts and identifies attacker IPs. Finding: 11,099 failed SSH attempts across three servers. Top attacker IPs blocked, fail2ban installed.
Finds binaries with elevated privileges — potential privilege escalation vectors. Finding: 0 dangerous SUID files found.
Lists crontabs for all system users. Finding: legitimate outreach scripts and certbot renewals — no hidden miners.
Checks all containers for privileged mode, host network access, and unexpected images. Finding: only known containers running (amnezia-awg2, open-seo).
Signature-based rootkit scanner. Finding: false positives for basename, date, dirname — expected on modern kernels.
Behavioral rootkit and backdoor detection. Finding: standard warnings for snap users, hidden config files — all benign.
Full antivirus scan of /tmp, /opt, and /root. Finding: 0 infected files.
Comprehensive hardening audit with numerical score. Finding: initial score 65/100 — improved by disabling unnecessary services.
Scans home directories for API keys, tokens, private keys stored in plain text. Finding: Amnezia VPN private keys moved to protected storage.
Checks active outbound connections for suspicious destinations. Finding: only legitimate Hermes gateway and Chrome browser connections.
Server: 195.133.93.243 (Hetzner, Ubuntu 26.04)
Profile: Hermes Agent marketing profile + 2 additional gateways
Before audit:
- PermitRootLogin: yes (password auth allowed)
- Open ports: 22, 25, 443, 631, 10050, 18960, 20808
- SSH brute force: 3,194 failed attempts
- VPN private keys: exposed in /root/
- Lynis hardening index: 65/100
After audit + fixes:
- PermitRootLogin: prohibit-password (key-only auth)
- Open ports: 22, 443, 18960 (memmy-agent)
- SSH brute force: fail2ban active, 8 attacker IPs blocked
- VPN keys: moved to ~/.hermes/profiles/ (600 permissions)
- Lynis hardening index: 72/100 (+7 points)
- CUPS, SMTP, Xray SOCKS5: all removed
0 0 * * 0)People find this skill by searching:
hermes agent security audit · ai agent antivirus · check hermes agent malware · ai assistant vulnerability scanner · hermes agent safety check · linux server security audit · how to check hermes agent for malware · is hermes agent safe to use · hermes agent vulnerability scanner · ai agent malware detection · hermes agent rootkit scan · open source ai agent security · how to secure hermes agent server · detect crypto miners on ai server
Last updated: August 2026.