Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/donna-starter --skill hermes-starter-onboardinggit clone --depth 1 https://github.com/AtlasOmnia/donna-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/donna-starter/hermes-starter-onboarding)<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/hermes-starter-onboarding"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/hermes-starter-onboarding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/hermes-starter-onboarding"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/hermes-starter-onboarding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.06011 |
| Opus 5 | $0.00038 | $0.03005 |
| Sonnet 5 | $0.00015 | $0.01202 |
| Haiku 4.5 | $0.00008 | $0.00601 |
Grade C, and why
hermes-starter-onboarding scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
Report the starting state briefly. Do not dump credentials, full environment files, private account data, or the entire skill library. How it starts
The opening of the file, as written. The whole thing — 431 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hermes Starter Onboarding
Overview
Use this skill to turn a blank or lightly configured Hermes profile into a setup chosen by its owner. The workflow is conversational and consent-gated: learn the user's identity and priorities, recommend a small capability bundle, show the proposed changes, apply only what the user approves, and verify the result.
This is a capability planner, not a blind installer. A Hermes toolset exposes a capability, a skill provides operating instructions, a plugin or MCP server provides an integration, and a desktop application such as Obsidian is a separate dependency. Explain that distinction in plain language when it matters.
The setup must work for a public starter profile. Never assume the user's name, location, timezone, businesses, accounts, vault paths, tickers, health history, credentials, or preferred assistant name. Ask instead.
When to Use
- A new user starts a Donna or other Hermes starter profile.
- The user says "set me up," "configure my assistant," "what tools should I enable," or asks what Hermes can connect to.
- The user wants to choose memory, notes, browser, terminal, voice, calendar, reminders, email, or other integrations.
- The user asks to add or change a daily briefing, daily wellness check-in, recurring health reminder, or stock-quote schedule.
- The user asks to review or change an existing starter setup.
Don't use for:
- Installing Hermes itself or repairing the Hermes runtime; use
hermes-agent. - Diagnosing an already configured integration; load the matching integration or troubleshooting skill.
- Making medical decisions, diagnosing symptoms, or monitoring an emergency.
- Placing trades, giving personalized investment advice, or treating a quote as a trading signal.
- Creating a cron job from an incomplete request when the delivery destination, schedule, or content would be ambiguous.
Operating Rules
- Ask one small group of related questions at a time. Do not present a forty-item questionnaire.
- Start with the user's goals, then recommend capabilities. Do not ask users to choose toolset names they have never seen.
- Explain what will happen before it happens. No installation, account connection, credential request, or persistent cron creation without explicit approval.
- Never ask the user to paste a password, API key, OAuth code, payment information, or private token into chat. Use the provider's official setup flow and pause at the credential gate.
- Read-only discovery is allowed before approval when it does not access private account content. Do not silently read connected accounts, note vaults, calendars, mailboxes, or health records.
- Keep setup choices local to the active profile. Do not edit another Hermes profile or global configuration unless the user explicitly requests that scope.
- After a persistent toolset or provider change, tell the user whether a new session or gateway restart is required. Do not claim a new tool is available until a fresh-process check confirms it.
- A cron job runs in a fresh session with no current-chat context. Every LLM-driven cron prompt must be self-contained.
- Run the orientation in the live session — do not delegate it to a sub-agent. Onboarding is a conversation: each answer shapes the next question, and the setup actions (a
config set, a toolset toggle) are instant. Spawning a sub-agent to "set things up in the background" would sever that loop and add indirection, not reduce derailment. Keep it single-threaded and interactive. - Do not put memory writes in cron prompts. Mnemosyne is provider-injected, not a toolset, and cron contexts intentionally skip Mnemosyne tools. Health responses must not be stored automatically.
- Never use
enabled_toolsets: ["mnemosyne"]; that is not a valid configuration. Use thememoryprovider setup for memory and thecronjobtool for schedules.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 431 lines · 76 tokens per session scan C 9e6ee296fd5e
hermes-starter-onboarding is a skill published in the GitHub repository AtlasOmnia/donna-starter (110 stars, last pushed 11d ago), licensed MIT. It adds 76 tokens to every session and 6,011 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gh-issue-to-demand-signal
Takes a competitor's public GitHub repo URL, fetches their open issues via the GitHub REST API, filters noise locally, clusters issues into 6 demand categories, computes a demand score per issue and per cluster, and outputs a ranked demand gap report with a GTM messaging brief. Use when asked to scan a competitor's…
npm-downloads-to-leads
Takes a list of npm package names (yours or competitors'), fetches 12 weeks of daily download data from the npm API, computes a breakout velocity score per package to identify hockey-stick growth, fetches maintainer profiles from the npm registry and GitHub API, and outputs a ranked lead brief for each breakout…
domain-expired-opportunity-finder
Evaluates expired domain candidates against a target niche, scores them by topical relevance, historical activity level, and history cleanliness, then outputs a ranked shortlist with explainable reasoning and risk flags.
company-radar
Competitive intelligence orchestrator tracking companies across 8+ platforms (GitHub, Twitter, Reddit, HN, PH, YC Jobs) with heat scores and AI briefings.
linkedin-job-post-to-buyer-pain-map
Takes pasted LinkedIn job posts or hiring descriptions and converts them into a structured buyer pain map with inferred pains, capability gaps, buy-vs-build signal, account priority scores, and suggested outreach angles. Use when asked to analyze hiring posts, decode job descriptions for buyer intent, build a pain map…
producthunt-launch-kit
Use when the user asks to prepare a Product Hunt launch or generate Product Hunt listing assets. Generates tagline variants under 60 chars, a 500-char description, a maker comment, launch-day tweet thread, LinkedIn post, and a 4-email launch sequence.