Eric-J

A remote authentication bypass exists in the `wx` Endpoint. The issue resides in the `verify server()` function within the `channel/wechatmp/common.py` file. Manipulation of the `wechatmp token` argument allows an attacker to bypass authentication because the system previously relied on a signature check that would degenerate into a predictable hash if the token was missing or empty. This allows unauthorized access via the '/wx' endpoint.

A security flaw in the Credential Pool Synchronization component allows for improper authentication. The issue resides in the ` sync anthropic entry from credentials file()` function within the `agent/credential pool.py` file. An attacker must have local access to initiate the attack.

An injection flaw exists in the ` sanitize env lines()` function within the `hermes cli/config.py` file. This issue allows for remote attacks, although exploitation is considered difficult and requires a high level of complexity.

A remote code injection issue exists in the ` serve plugin skill/skill view` function within the `tools/skills tool.py` file. A remote attacker can perform a manipulation that leads to injection.

A remote resource consumption issue exists in the Webhook Endpoint component. The flaw is located within the ` handle webhook request()` function in the `gateway/platforms/feishu.py` file, allowing a remote attacker to cause excessive resource consumption.

A remote injection flaw exists in the ` scan memory content()` function within the `tools/memory tool.py` file. This weakness allows a remote attacker to initiate an injection attack.

An injection issue exists in the ` compress context()` function within the `run agent.py` file. This flaw allows a remote attacker to perform an injection attack through the manipulation of the function.