hermes-agent/optional-skills/research
JiahuiGu 0a2ee71ccc
fix(skill): guard pickle.loads in darwinian-evolver show_snapshot with explicit flag (#29276)
show_snapshot.py unpickled a user-supplied path unconditionally. pickle.loads
is equivalent to arbitrary code execution, so a snapshot from an untrusted
source = RCE. Require an explicit --i-trust-this-file acknowledgement before
calling pickle.loads, and emit a stderr warning when proceeding.

Co-authored-by: Jiahui-Gu <jiahuigu@users.noreply.github.com>
2026-05-25 01:51:21 -07:00
..
bioinformatics
darwinian-evolver fix(skill): guard pickle.loads in darwinian-evolver show_snapshot with explicit flag (#29276) 2026-05-25 01:51:21 -07:00
domain-intel
drug-discovery
duckduckgo-search
gitnexus-explorer
osint-investigation
parallel-cli
qmd
scrapling
searxng-search