Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gerodp/hermes-productivity-skills --skill umami-reportgit clone --depth 1 https://github.com/gerodp/hermes-productivity-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gerodp/hermes-productivity-skills/umami-report)<a href="https://agentmods.dev/skills/gerodp/hermes-productivity-skills/umami-report"><img src="https://agentmods.dev/badge/skills/gerodp/hermes-productivity-skills/umami-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gerodp/hermes-productivity-skills/umami-report"><img src="https://agentmods.dev/badge/skills/gerodp/hermes-productivity-skills/umami-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.01292 |
| Opus 5 | $0.00012 | $0.00646 |
| Sonnet 5 | $0.00005 | $0.00258 |
| Haiku 4.5 | $0.00002 | $0.00129 |
Grade C, and why
umami-report scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
them themselves — guide them, do not collect secrets in chat: How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Umami Report
Report visitor and pageview numbers for every website on a private, self-hosted Umami analytics instance — in one command. Zero dependencies (Python stdlib only); all sites are queried concurrently so a full report returns in a couple of seconds. Each metric is shown with its delta versus the previous equal-length period (▲/▼).
Script path: ~/.hermes/skills/analytics/umami-report/scripts/umami_report.py
When to Use
- User asks "how many visitors did my sites get?" / "traffic report" /
"umami stats" / "pageviews this week/month" →
report - User wants one site only →
report --site <name> - User wants a specific window →
report --days Nor--sinceor--start/--end - User wants machine-readable output to post-process →
report --json
Prerequisites
Python 3.8+ (stdlib only — no installs). Three environment variables, injected
automatically into the sandbox from ~/.hermes/.env:
UMAMI_URL, UMAMI_USERNAME, UMAMI_PASSWORD.
Always run check first. If it reports missing variables, the user must set
them themselves — guide them, do not collect secrets in chat:
hermes config # edit config, or
$EDITOR ~/.hermes/.env # add: UMAMI_URL=..., UMAMI_USERNAME=..., UMAMI_PASSWORD=...
~/.hermes/.env is mode 600. After editing, re-run check.
Secret Safety (MANDATORY)
- Never print, echo,
cat, or interpolate$UMAMI_PASSWORD(or the other vars) into a command line, log, or chat message. - Never ask the user to paste their password into the conversation — they
set it in
~/.hermes/.envon their own machine. - To confirm credentials work, use only the
checkcommand. The script is written to never print secrets or the auth token.
Commands
SCRIPT=~/.hermes/skills/analytics/umami-report/scripts/umami_report.py
check — verify config + login
python3 $SCRIPT check
Prints OK — authenticated to <url>; N website(s) visible. on success, or a
clear, secret-free error. Exit code is non-zero on any failure.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 133 lines · 23 tokens per session scan C fbf39b3627a3
umami-report is a skill published in the GitHub repository gerodp/hermes-productivity-skills (3 stars, last pushed yesterday), licensed MIT. It adds 23 tokens to every session and 1,292 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
seo
Use and read this skill immediately if the user request is in any way related to SEO or a site's organic search or AI search presence. That includes site audits, rankings, keyword research, competitors, backlinks, click or traffic changes, indexing problems, crawling, redirects, sitemaps, metadata, structured data…
pad
Talk to your project. Natural-language project management — create items, check status, plan work, brainstorm ideas, and more.
gno
Search local documents, files, notes, and knowledge bases. Index directories, search with BM25/vector/hybrid, get AI answers with citations. Use when user wants to search files, find documents, query notes, look up information in local folders, index a directory, set up document search, build a knowledge base, needs…
memorywhale
Query and write durable debugging memory recorded by MemoryWhale. Use when debugging a failure that may have happened before, when you need the exact error/flags/output from an earlier attempt, when the user asks "how did we fix this last time?", or once you've figured out why something failed / how a fix worked and…
capture
Capture a thought as a Pad item without breaking flow.
connect
Connect this session to Pad's push/watch stream — consent to receive pushes, and run the workspace's on-session-start ritual on first connect.