ocas-mentor
Mentor orchestrates and evaluates multi-skill workflows, proposing improvements based on performance analysis and project management.
Install this skill
Security score
The ocas-mentor skill was audited on Jun 15, 2026 and we found 16 security issues across 2 threat categories, including 7 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 145 | # CRITICAL: Use `python3 << 'PYEOF'` heredoc for backup writes, NOT shell `printf` with variable interpolation — Shell variable expansion inside heredocs can introduce stray braces (e.g., `${DATA_DIR} |
Template literal with variable interpolation in command context
| 153 | NEVER use `printf '%s\\n' "${SOME_VAR}" >> path` where `path` contains shell variables — the `}` in `${VAR}` can double up and produce paths like `file.jsonl}`. If you must use shell interpolation, us |
Template literal with variable interpolation in command context
| 221 | **Heredoc journal file naming:** `cat > "$JOURNAL_DIR/${RUN_ID}.json" << 'EOF'` may create a file literally named `.json`. Compose the filename in a separate variable first, then reference without bra |
Template literal with variable interpolation in command context
| 305 | - **Backup journal double-prefix** — If RUN_ID already contains `mentor-light-`, filename is `"$RUN_ID.json"` not `"mentor-light-${RUN_ID}.json"`. See gotcha #43. |
Python subprocess execution
| 135 | **Sandbox file discovery failure:** In the cron sandbox, Python's `subprocess.run(["find", ...])` and `os.walk()` silently return 0 results even when the filesystem is fully accessible via shell tools |
Access to root home directory
| 88 | Mentor reads journals from all skills at: `{agent_root}/commons/journals/` (recursive scan). **NOTE:** The deep heartbeat script (`cron-heartbeat-deep.py`) currently only scans `/root/.hermes/commons/ |
Access to root home directory
| 167 | EVIDENCE_BEFORE=$(wc -l < /root/.hermes/commons/data/mentor/evidence.jsonl) |
Access to root home directory
| 168 | INGESTION_BEFORE=$(wc -l < /root/.hermes/commons/data/mentor/ingestion_log.jsonl) |
Access to root home directory
| 169 | JOURNAL_DIR="/root/.hermes/profiles/indigo/commons/journals/ocas-mentor/$(date -u +%Y-%m-%d)" |
Access to root home directory
| 175 | EVIDENCE_AFTER=$(wc -l < /root/.hermes/commons/data/mentor/evidence.jsonl) |
Access to root home directory
| 176 | INGESTION_AFTER=$(wc -l < /root/.hermes/commons/data/mentor/ingestion_log.jsonl) |
Access to root home directory
| 181 | printf '%s\\n' '{...evidence json...}' >> /root/.hermes/commons/data/mentor/evidence.jsonl |
Access to root home directory
| 196 | # IMPORTANT: $JOURNAL_DIR must use UTC date: JOURNAL_DIR="/root/.hermes/profiles/indigo/commons/journals/ocas-mentor/$(date -u +%Y-%m-%d)" |
Access to root home directory
| 205 | ACTIVE_OCAS_30D=$(find /root/.hermes/commons/journals/ /root/.hermes/profiles/indigo/commons/journals/ -name "*.json" -mtime -30 2>/dev/null | grep -oP 'ocas-[a-z]+' | sort -u | wc -l) |
Access to root home directory
| 208 | ACTIVE_ALL_30D=$(find /root/.hermes/commons/journals/ /root/.hermes/profiles/indigo/commons/journals/ -name "*.json" -mtime -30 2>/dev/null | grep -oP 'commons/journals/([a-z][a-z0-9_-]+)' | sed 's|co |
Access to root home directory
| 294 | - **`JOURNALS_DIR` path must match `find` output** — Must be `/root/.hermes/commons/journals`, NOT the profile-scoped path. |