Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MilkyWay008/Hermes-OTG --skill airtablegit clone --depth 1 https://github.com/MilkyWay008/Hermes-OTGWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/milkyway008/hermes-otg/airtable)<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/airtable"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/airtable/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/airtable"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/airtable.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.03244 |
| Opus 5 | $0.00010 | $0.01622 |
| Sonnet 5 | $0.00004 | $0.00649 |
| Haiku 4.5 | $0.00002 | $0.00324 |
Grade A, and why
airtable scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Airtable REST API via curl. Records CRUD, filters, upserts. This is a copy
97% identical to airtable — 40 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Airtable — Bases, Tables & Records
Work with Airtable's REST API directly via curl using the terminal tool. No MCP server, no OAuth flow, no Python SDK — just curl and a personal access token.
Prerequisites
- Create a Personal Access Token (PAT) at https://airtable.com/create/tokens (tokens start with
pat...). - Grant these scopes (minimum):
data.records:read— read rowsdata.records:write— create / update / delete rowsschema.bases:read— list bases and tables
- Important: in the same token UI, add each base you want to access to the token's Access list. PATs are scoped per-base — a valid token on the wrong base returns
403. - Store the token in
${HERMES_HOME:-~/.hermes}/.env(or viahermes setup):AIRTABLE_API_KEY=pat_your_token_here
Note: legacy
key...API keys were deprecated Feb 2024. Only PATs and OAuth tokens work now.
API Basics
- Endpoint:
https://api.airtable.com/v0 - Auth header:
Authorization: Bearer $AIRTABLE_API_KEY - All requests use JSON (
Content-Type: application/jsonfor any POST/PATCH/PUT body). - Object IDs: bases
app..., tablestbl..., recordsrec..., fieldsfld.... IDs never change; names can. Prefer IDs in automations. - Rate limit: 5 requests/sec/base.
429→ back off. Burst on a single base will be throttled.
Base curl pattern:
curl -s "https://api.airtable.com/v0/$BASE_ID/$TABLE?maxRecords=5" \
-H "Authorization: Bearer $AIRTABLE_API_KEY" | python3 -m json.tool
-s suppresses curl's progress bar — keep it set for every call so the tool output stays clean for Hermes. Pipe through python3 -m json.tool (always present) or jq (if installed) for readable JSON.
Field Types (request body shapes)
| Field type | Write shape |
|---|---|
| Single line text | "Name": "hello" |
| Long text | "Notes": "multi\nline" |
| Number | "Score": 42 |
| Checkbox | "Done": true |
| Single select | "Status": "Todo" (name must already exist unless typecast: true) |
| Multi-select | "Tags": ["urgent", "bug"] |
| Date | "Due": "2026-04-01" |
| DateTime (UTC) | "At": "2026-04-01T14:30:00.000Z" |
| URL / Email / Phone | "Link": "https://…" |
| Attachment | "Files": [{"url": "https://…"}] (Airtable fetches + rehosts) |
| Linked record | "Owner": ["recXXXXXXXXXXXXXX"] (array of record IDs) |
| User | "AssignedTo": {"id": "usrXXXXXXXXXXXXXX"} |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 230 lines · 19 tokens per session scan A 016198b563b8
airtable is a skill published in the GitHub repository MilkyWay008/Hermes-OTG (15 stars, last pushed 29d ago), licensed MIT. It adds 19 tokens to every session and 3,244 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 97% identical to airtable, differing in 40 lines, and is treated as a copy.
Other skills, from other repositories
hunt-sqli
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection…
hunt-nosqli
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
hunt-supabase
Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organizationid check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-tenant enumeration…
firebase-supabase-attack
Exploit Firebase/Supabase for data via JS config leak probe.
hermes-mnemosyne
Mnemosyne is Hermes' primary local-first memory engine — SQLite with vector + FTS5 hybrid search, 19+ tools, auto-consolidation, and a standalone CLI. It's a pip-installed plugin (not a built-in toolset) discovered via $HERMESHOME/plugins/mnemosyne/.
db
Run read-only SQL queries against Supabase databases (local or remote). Use when inspecting schema, debugging data, checking migrations, or answering questions about database state.