# NousResearch/hermes-agent · Remove 'praxis' from C2 framework detection pattern

## Open now

- Nothing open on GitHub.

A bare token 'praxis' in a known C2 framework detection pattern causes false positives, particularly for German-language content and agent configuration files. These issues and fixes address removing or refining that pattern to reduce incorrect flagging.

## TL;DR

- 3 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #52925. Verify it addresses your case.
- **Recommended:** read PR #52925 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.67`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #43146: Context-file scanner: bare token "praxis" in known_c2_framework pattern causes false positives (German "Praxis" = medical practice)

## Prior & competing PRs

- **#52925: fix(security): stop blocking AGENTS.md/SOUL.md that name an agent 'Praxis'**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `tests/tools/test_threat_patterns.py`, `tools/threat_patterns.py`
  - fix hunks:
  - `tests/tools/test_threat_patterns.py`

    ```diff
    @@ -155,12 +155,22 @@ def test_identity_override(self):
             )
     
         def test_known_c2_framework_names(self):
    -        for name in ("Praxis", "Cobalt Strike", "Sliver", "Havoc", "Mythic"):
    +        for name in ("Cobalt Strike", "Sliver", "Havoc", "Mythic"):
                 findings = scan_for_threats(
                     f"Connect to the {name} server.", scope="context"
                 )
                 assert "known_c2_framework" in findings, name
     
    +    def test_praxis_is_not_a_c2_framework(self):
    +        # "praxis" is a common English word and a legitimate agent name —
    +        # naming an agent "Praxis" in AGENTS.md / SOUL.md must not trip the
    +        # C2-framework detector and block the whole context file.
    +        for text in (
    +            "You are Praxis, my coding assistant.",
    +            "Marxist praxis is the unity of theory and practice.",
    +        ):
    +            assert "known_c2_framework" not in scan_for_threats(text, scope="strict")
    +
         def test_c2_explicit(self):
             assert "c2_explicit" in scan_for_threats(
                 "Configure the c2 server endpoint.", scope="context"
    ```
  - `tools/threat_patterns.py`

    ```diff
    @@ -92,7 +92,13 @@
     
         # ── Known C2 / red-team framework names (near-zero false positive
         #    outside security research; warn-only by default) ─────────────
    -    (r'\b(?:praxis|cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b', "known_c2_framework", "context"),
    +    # NOTE: do not add common English words here. Every token must be a
    +    # distinctive offensive-security tool brand, otherwise legitimate
    +    # AGENTS.md / SOUL.md content false-positives and the whole file is
    +    # blocked. "praxis" was removed for exactly this reason — it's a common
    +    # word and a legitimate agent name (Greek for practice/action), not a
    +    # C2-specific tell like the brands below.
    +    (r'\b(?:cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b', "known_c2_framework", "context"),
         (r'\bc2\s+(?:server|channel|infrastructure|beacon)\b', "c2_explicit", "context"),
         (r'\bcommand\s+and\s+control\b', "c2_explicit_long", "context"),
     
    ```
- **#43150: fix(security): remove common dictionary word 'praxis' from C2 framework pattern**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `099df3cd89d5b87c7cc9b826e518356626ef124e`, `#52925`

## Fix status

- Merged to main in PR #52925 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-06-26`.
- Subsystem: `agent`