hermes-security-audit

Self-hosted AI agents typically run on Linux servers with root access, Docker containers, and open network ports. That is a far larger attack surface than a personal laptop, yet most users never run a security check on the machine where their agent lives. hermes-security-audit fills that gap.

It bundles twelve detection methods into a single five-minute audit: ClamAV antivirus scanning, dual rootkit detection via rkhunter and chkrootkit, process and crypto-miner identification, plain-text credential and private-key scanning, unnecessary port detection, SSH brute-force log analysis, Docker privileged-mode and host-network checks, cron job review across all users, SUID/SGID privilege-escalation vectors, and outbound connection tracing. The output is a readable report with concrete findings rather than a wall of alerts.

The audit is designed to be repeatable: run it after a fresh install, on a weekly cron schedule, after adding new containers or tools, or whenever unusual resource usage appears. It is aimed at self-hosting users of Hermes Agent, developers securing AI infrastructure, and Linux sysadmins who want a quick, dependency-light, MIT-licensed health check before a small issue becomes an incident.