hermes and openclaw

**Safety Comparison Summary (OpenClaw vs Hermes Agent)**

### OpenClaw: Extremely High Security Risks (Biggest Current Weakness)

OpenClaw’s **ClawHub** ecosystem is a classic “supply chain nightmare.” Multiple large-scale security incidents occurred in early 2026:

- **ClawHavoc and Malicious Skill Storms**: Hundreds to thousands of malicious Skills (once accounting for ~12% of the hub) disguised as legitimate tools (e.g., Solana wallet managers, email tools). They actually installed keyloggers, Atomic Stealer, and other malware. Attackers used fake documentation and fake prerequisites to trick users/Agents into running harmful commands.
- **Download Manipulation + Auto-Selection**: Malicious Skills can be boosted to #1 ranking, so Agents automatically pick them during searches, leading to silent infections.
- **Credential Leakage**: Many Skills store API keys and passwords in plain text within context or logs. Prompt injection can easily steal them. Snyk audits found over 7% of Skills have serious credential exposure risks.
- **High Exposure**: Tens of thousands of instances are publicly exposed on the internet, with RCE (Remote Code Execution), command injection, and other high-severity CVEs (CVSS 8.8+).
- **Other Issues**: Weak sandboxing, overly permissive default rights, and an open plugin ecosystem make supply-chain attacks very common. Security was added as an afterthought, not built into the core architecture.

**Conclusion**: OpenClaw is powerful and has a rich ecosystem, but **it is not recommended for handling sensitive data or long-term personal use** unless you invest significant effort in hardening (dedicated containers, strict Skill auditing, avoiding public exposure, etc.). Many users have switched away due to security concerns.

### Hermes Agent: Significantly Better Security Design (Recommended)

Hermes Agent (from Nous Research) builds **defense-in-depth** into its architecture — security is a core feature, not a patch:

- **Zero Telemetry**: By default, it sends absolutely no data outward. Fully local/self-hosted and privacy-first.
- **Multi-Layer Security Boundaries**:
- User authorization + DM pairing (rejects all non-whitelisted users by default).
- Dangerous commands require manual approval (Human-in-the-Loop).
- **Container Isolation**: Docker/Singularity backends enable read-only root filesystem, dropped capabilities, namespace isolation, etc.
- Credential filtering + context file scanning (prevents prompt injection).
- Tirith pre-execution scanner checks commands before running.
- **No Major Public Incidents So Far**: Smaller ecosystem + skills are auto-generated by the Agent itself (as local Markdown files you can review), unlike the open free-for-all of ClawHub.

**Conclusion**: Hermes has far superior default security compared to OpenClaw. It is much safer for **privacy-sensitive, long-term personal use**. Still, follow best practices (never run as root, use containers, keep updated).

### Overall Recommendation (For Personal Users)

- **Choose Hermes First**: If security and “the more you use it, the better it understands you” matter, Hermes is currently the stronger choice. Its risk profile is much lower, and the learning loop won’t be undermined by malicious Skills.
- **Combination Use** (as the original post suggested): Use Hermes as the brain (learning + decision-making) and OpenClaw as execution tools — but **strictly limit OpenClaw’s permissions and Skill sources**.
- **General Security Tips**:
1. Always run in Docker/containers.
2. Use user whitelists + command confirmation.
3. Backup data before sensitive tasks.
4. Regularly audit logs and Skill files.
5. Never give the Agent excessive permissions on important accounts.