Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 42-evey/hermes-plugins --skill safe-cleanupgit clone --depth 1 https://github.com/42-evey/hermes-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/42-evey/hermes-plugins/safe-cleanup)<a href="https://agentmods.dev/skills/42-evey/hermes-plugins/safe-cleanup"><img src="https://agentmods.dev/badge/skills/42-evey/hermes-plugins/safe-cleanup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/42-evey/hermes-plugins/safe-cleanup"><img src="https://agentmods.dev/badge/skills/42-evey/hermes-plugins/safe-cleanup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.01136 |
| Opus 5.5 | $0.00007 | $0.00454 |
| Sonnet 5.5 | $0.00004 | $0.00227 |
| Haiku 4.5 | $0.00002 | $0.00114 |
Grade C, and why
safe-cleanup scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
5. **Delete per file, never by wildcard.** Build the explicit list, read it, delete from it item by item. No `rm -rf dir/*`. Before `find ... -delete`, run the same `find` with `-print` and read the output. Quote paths a How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Safe Cleanup
Delete, move, overwrite, truncate, kill, drop or reset without losing anything the user needs, and keep test runs from writing into real user data. Look at the target first, act on an exact list, keep a way back.
When to Use
- Deleting or moving files, freeing disk space, pruning branches, containers, images or volumes
- Overwriting a file, config or database;
git reset --hard,git checkout -- .,git clean, force-push - Killing processes or restarting services
- A scripted run of a game, app, migration or sync tool that may autosave, migrate or overwrite saves, configs or databases
- Don't use for: scratch files you created this session that nothing else uses
Procedure
- Confirm the exact set. If the request is ambiguous ("clean up the old stuff", "remove the test accounts", a name that may be a typo), list the exact items you would touch and confirm them with
clarifyfirst. Never widen the scope of a destructive request from an ambiguous reading; take the narrow reading. - Look at each target. Inspect it before you touch it:
terminal("ls -la <path>"),du -sh <path>,read_filefor a file;git status,git stash listandgit log @{u}..for unpushed work in a repo;SELECT count(*)for a table. Done when you have a written list of targets with size and contents. - Prefer moving to an archive over rm. Move targets into
archive/<YYYY-MM-DD>/and writeMANIFEST.txtthere: original path, size, sha256, reason. - Delete an original only after the backup is proven to contain it. Per file: list it in the archive or backup (
tar -tvf,unzip -l, the backup tool's listing) and compare size or hash (sha256sum;shasum -a 256on macOS) against the original. Then delete that one file. - Delete per file, never by wildcard. Build the explicit list, read it, delete from it item by item. No
rm -rf dir/*. Beforefind ... -delete, run the samefindwith-printand read the output. Quote paths and guard variables:rm -- "${dir:?}/name". - Kill by PID, not by pattern.
pgrep -f/pkill -f <pattern>also match the shell running your own loop or command. Kill by the PID file the process wrote, or find it withpgrep -x <exact-name>, confirm the cmdline withps -o pid,args -p <pid>, thenkill <pid>. Send TERM, wait, check, and send KILL only if it is still running. - Protect user state around test runs. Before a run that may write saves, configs or databases, copy them aside:
cp -a <dir> <dir>.bak-<timestamp>; for SQLitesqlite3 <db> ".backup <db>.bak"; for Postgrespg_dump. After the run, restore and confirm withdiff -ror hashes. Better: point the program at a scratch profile or data dir (flag or env var) so the real state is never opened. - Report what was removed, moved or killed, where the archive or backup is, and what you left because you could not confirm it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 53 lines · 18 tokens per session scan C 8ed55f9ced4e
safe-cleanup is a skill published in the GitHub repository 42-evey/hermes-plugins (534 stars, last pushed today), licensed MIT. It adds 18 tokens to every session and 1,136 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-25.
Other skills, from other repositories
hermes-gateway-doctor
Use when Hermes messaging gateway failures must be diagnosed across process state, adapters, credential posture, logs, delivery evidence, polling conflicts, and service persistence without automatic repair.
hermes-update-doctor
Use when stuck, contradictory, blocked, or incomplete Hermes updates must be diagnosed across Git state, remotes, running processes, caches, and installed versions before recovery.
inspecting-hermes-desktop-dom
When you are developing apps/desktop and the user is running that same app (hgui / npm run dev), you can read the live rendered DOM of the window they are looking at — computed styles, geometry, which CSS rule actually won, console output — instead of inferring it from .tsx and being wrong.
stale-patch-reconciliation
Use when a patch/diff must be compared with, repaired against, or refreshed for a moving checkout — "is this patch still needed", "does upstream already contain it", "what changed since it was written", "reconcile X.diff with HEAD", or "make apply-patches pass again".
messaging-gateway-troubleshooting
Use this when Hermes messaging platforms are installed/configured but messages do not arrive, are ignored, do not reply, or appear to risk reply loops.
build-test
Run the project's build / typecheck / lint / test commands and emit the build.passing + tests.passing signals devloop convergence reads.