Issues · badMade/hermes-agent · GitHub

Labels Milestones New issue

Yes, the security concern regarding subprocess environment leakage remains valid and is a critical issue. The fix involves ensuring that any `subprocess.run` or `subprocess.Popen` call that executes external commands (like `ffmpeg` or `npm`) does not inherit the full environment of the parent process, which may contain sensitive API keys.

#698

· badMade opened

on Jun 3, 2026

The suggestion is indeed still valid and highly recommended to prevent environment variable leakage. To implement this fix, you should update the `subprocess.run` call in `hermes_cli/tools_config.py` at lines 911-916 to include the `env` parameter using the `_sanitize_subprocess_env` helper.

#695

· badMade opened

on Jun 3, 2026

The suggestion provided in the initial review is indeed correct and still valid. To implement this fix, you should sanitize the environment dictionary using `_sanitize_subprocess_env` before passing it to `subprocess.run`. This prevents the child process from inheriting sensitive API keys from the parent process environment.

#694

· badMade opened

on Jun 3, 2026

@jules fix:

#684

· badMade opened

on Jun 1, 2026

@jules code review

#683

· badMade opened

on Jun 1, 2026