Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MilkyWay008/Hermes-OTG --skill hermes-update-fail-rescuegit clone --depth 1 https://github.com/MilkyWay008/Hermes-OTGWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/milkyway008/hermes-otg/hermes-update-fail-rescue)<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/hermes-update-fail-rescue"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/hermes-update-fail-rescue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/hermes-update-fail-rescue"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/hermes-update-fail-rescue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.02012 |
| Opus 5 | $0.00010 | $0.01006 |
| Sonnet 5 | $0.00004 | $0.00402 |
| Haiku 4.5 | $0.00002 | $0.00201 |
Grade A, and why
hermes-update-fail-rescue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hermes Update-Fail Rescue
TRIGGER: the user reports "Hermes update failed", "Hermes won't start after an update", "the update broke my install", or the desktop app sits forever on "update in progress — deferring backend start". Also fires when the agent is asked to fix a host Hermes install while itself running from a portable/OTG instance.
The failure class
Hermes updates run a staged bootstrap (hermes-setup.exe --update → install
script). A failure mid-way leaves the install HALF-updated: new source + broken
venv = the app won't start. The three most common root causes (they combine):
| # | Root cause | Fix |
|---|---|---|
| 1 | uv hardlink failure — os error 396 at the dependencies stage (Failed to install: <pkg> + "cloud operation ... incompatible hardlinks") |
set UV_LINK_MODE=copy — uv copies instead of hardlinks |
| 2 | Env leak redirects the updater to the wrong install (a portable HERMES_HOME inherited by the host updater makes it target the portable install) |
load env-safe-execution; scrub env / hand off |
| 3 | Live Hermes processes hold the venv (gateway services, dashboards) while the bootstrap rebuilds it → file contention, often surfacing AS #1 | stop every Hermes process BEFORE the update |
Diagnose (read-only first — never run the updater yet)
- Logs —
%LOCALAPPDATA%\hermes\logs\:bootstrap-installer.log— the updater's own log. Grep forbootstrap FAILED,Failed to install,os error,stage=,InstallDir=,HermesHome=.desktop.log— "update in progress (pid=NNNN); deferring backend start" = updater died leaving a stale marker.errors.log—ModuleNotFoundErrorat boot import = half-built venv.
- Markers —
.hermes-update-in-progress(stale if its PID is dead — kills the desktop's startup deferral),.update_check,.update_exit_code. - Venv —
hermes-agent\venv\Scripts\python.exe -c "import hermes_cli.main"must import cleanly. - Git —
git rev-parse HEAD,git status --short(note local patches BEFORE anything runs). - Registry —
reg query "HKCU\Environment" /v HERMES_HOME— must be the HOST install, never a portable one. - Hardlink reproduction —
references/396-diagnosis.md(pythonos.linkprobes + a realuv pip installinto a throwaway temp venv). If 396 does NOT reproduce, the cause was transient (live-process file contention) — run the fix anyway; copy mode is harmless and makes the class impossible.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 113 lines · 20 tokens per session scan A fa5a4e8490e6
hermes-update-fail-rescue is a skill published in the GitHub repository MilkyWay008/Hermes-OTG (15 stars, last pushed 28d ago), licensed MIT. It adds 20 tokens to every session and 2,012 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
flask-werkzeug-attack
Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
nsm-session-pivot
Pivot through Zeek session and protocol metadata from a packet capture (read-only) — connection listing, service filtering, and following a connection uid into dns/http/ssl logs. Use when reconstructing what sessions occurred in a capture, following a connection across protocols, or investigating retrospectively.
hermes-plugin-development
Use when: creating, debugging, or integrating Hermes Agent plugins, including Python backend plugins (tools, hooks, routers, middleware) and JavaScript Hermes Desktop runtime plugins.
node-inspect-debugger
Debug Node.js with node inspect, inspector attach, breakpoints, Chrome DevTools Protocol, heap snapshots, and CPU profiles.
python-debugpy
Debug Python with pdb, breakpoint(), post-mortem inspection, and debugpy remote or headless attach.
incident-commander
Autonomous incident detection, root-cause analysis, and self-healing for Linux/Docker production environments. Activate when the user mentions: server down, high CPU, memory leak, disk full, service crash, deployment failure, alert firing, on-call page, or any infrastructure emergency. Also activates on scheduled…