Hermes Agent Community Reports Delegation Permission Gap: Subagents May Get Terminal Tools Disabled in Their Target Profile

Hermes Agent’s profile delegation mechanism may not match expected tool permissions. An issue filed on November 1 says that when using the profile_routes backend of the advanced-delegation plugin, a subagent delegated from another profile may still get terminal access even when the target profile has terminal tools disabled. The reported setup used Hermes 0.22.5 and plugin 1.0.0 in Docker; the evidence comes from one user’s comparison test. Issue and reproduction steps

The test configured video-editor to enable only file operations, skills, and clarification tools, while leaving terminal access enabled in the parent profile. When launched directly, the target profile’s agent said it had no terminal tool and did not create the test file. When the parent agent delegated the same task, the subagent’s tool list included terminal, and it ran a command to create a file with a specified timestamp. The author also says the parent agent’s trace showed only delegation and log-reading activity, with no record of the parent calling the terminal itself. Test results

The official documentation provides important context: ordinary delegate_task subagents already inherit the parent agent’s enabled tool set, and the model cannot pass a tool-set parameter to grant itself additional capabilities; some tools also have subagent restrictions. The report therefore raises the question of which tool configuration should apply when switching profile routes. It is not enough to classify the behavior as a confirmed privilege-escalation vulnerability. Tool inheritance rules

For engineering teams, the technical issue is whether profile identity, model routing, and tool capabilities have consistent boundaries when a route changes. If a workflow treats a profile with terminal access disabled as a restricted worker, but a parent agent with terminal access launches it, the tools actually available may differ from the deployer’s expectations. This is an inference about deployment risk based on the report and documentation; there is no public evidence of malicious exploitation.

As of this review, the issue remains open, with no maintainer confirmation or linked fix. Watch how the project defines the tool contract for profile routing and whether it adds permission comparison tests for direct and delegated launches. Teams using these routes should also check the actual tool list available to subagents. Issue status