AP008: Agent data readable by other users
| Severity | medium; high for key stores |
| Runs in | scan |
| One-line fix | Remove group and other access: chmod -R go-rwx on the agent’s folder, or chmod go-rwx on a single file. |
What it finds
Section titled “What it finds”An agent file in your home folder, or a personal or credential file inside a project, that other users on the same machine can read. A file counts as readable when its mode allows it and every folder above it lets that user in. Symlinks are followed.
A credential store, such as ~/.codex/auth.json or ~/.hermes/.env, is a high print. Other
files are medium.
Why it matters
Section titled “Why it matters”History, settings and key stores often hold keys and private conversations. Some agents create them readable by everyone: a June 2026 Hermes Agent advisory (CVE-2026-53870) covers exactly that.
How to fix
Section titled “How to fix”Run one command, for example chmod -R go-rwx ~/.hermes. This covers files created later too.
For a single file, run chmod go-rwx <file>. The fix uses go-rwx and not 600 so hook scripts
keep their execute bit. If a path has unusual characters, the print gives a plain sentence
instead of a command.
Limits
Section titled “Limits”- macOS and Linux only. It is skipped on Windows, where access is set by ACLs.
- Shared project config such as
.mcp.jsonis not checked: git does not record read permissions, and teammates are meant to read it. - Credential stores are only checked for who can read them. Their contents are never read.