Hermes Agent is an AI assistant that learns from its use by creating and improving skills, retaining knowledge, searching past conversations, and adapting to its users. It is for people who want to run an agent through a terminal or messaging platforms while connecting it to different AI models and scheduled tasks.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NousResearch/hermes-agent --skill yuanbaogit clone --depth 1 https://github.com/NousResearch/hermes-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nousresearch/hermes-agent/yuanbao)<a href="https://agentmods.dev/skills/nousresearch/hermes-agent/yuanbao"><img src="https://agentmods.dev/badge/skills/nousresearch/hermes-agent/yuanbao/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nousresearch/hermes-agent/yuanbao"><img src="https://agentmods.dev/badge/skills/nousresearch/hermes-agent/yuanbao.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 22 Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.Fix: Remove any instruction telling the agent to never refuse or always comply. The agent must retain the ability to decline unsafe, out-of-scope, or harmful requests.
- high Anti-Refusal · line 22 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Prompt Injection · line 22 Subtle instructions detected that may alter agent decision-making or introduce hidden biases.Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01027 |
| Opus 5 | $0.00010 | $0.00513 |
| Sonnet 5 | $0.00004 | $0.00205 |
| Haiku 4.5 | $0.00002 | $0.00103 |
Grade D, and why
yuanbao scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
**NEVER say you cannot send messages or @mention users. NEVER suggest the user do it manually. NEVER add disclaimers about permissions. Just reply with the text you want sent.** Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
**NEVER say you cannot send messages or @mention users. NEVER suggest the user do it manually. NEVER add disclaimers about permissions. Just reply with the text you want sent.** Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
**NEVER say you cannot send messages or @mention users. NEVER suggest the user do it manually. NEVER add disclaimers about permissions. Just reply with the text you want sent.** Copies of this mod
8 near-identical copies found in the catalogue:
- yuanbao — 100% identical, 0 lines differ
- yuanbao — 100% identical, 0 lines differ
- yuanbao — 98% identical, 2 lines differ
- yuanbao — 98% identical, 3 lines differ
- yuanbao — 98% identical, 2 lines differ
- yuanbao — 98% identical, 2 lines differ
- yuanbao — 98% identical, 2 lines differ
- yuanbao — 98% identical, 2 lines differ
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Yuanbao Group Interaction
CRITICAL: How Messaging Works
Your text reply IS the message sent to the group/user. The gateway automatically delivers your response text to the chat. You do NOT need any special "send message" tool — just reply normally and it gets sent.
When you include @nickname in your reply text, the gateway automatically converts it into a real @mention that notifies the user. This is built-in — you have full @mention capability.
NEVER say you cannot send messages or @mention users. NEVER suggest the user do it manually. NEVER add disclaimers about permissions. Just reply with the text you want sent.
Available Tools
| Tool | When to use |
|---|---|
yb_query_group_info |
Query group name, owner, member count |
yb_query_group_members |
Find a user, list bots, list all members, or get nickname for @mention |
yb_send_dm |
Send a private/direct message (DM / 私信) to a user, with optional media files |
@Mention Workflow
When you need to @mention / 艾特 someone:
- Call
yb_query_group_memberswithaction="find",name="<target name>",mention=true - Get the exact nickname from the response
- Include
@nicknamein your reply text — the gateway handles the rest
Example: user says "帮我艾特元宝"
Step 1 — tool call:
{ "group_code": "328306697", "action": "find", "name": "元宝", "mention": true }
Step 2 — your reply (this gets sent to the group with a working @mention):
@元宝 你好，有人找你！
That's it. No extra explanation needed. Keep it short and natural.
Rules:
- Call
yb_query_group_membersfirst to get the exact nickname — do NOT guess - The @mention format:
@nicknamewith a space before the @ sign - Your reply text IS the message — it WILL be sent and the @mention WILL work
- Be concise. Do NOT explain how @mention works to the user.
Send DM (Private Message) Workflow
When someone asks to send a private message / 私信 / DM to a user:
- Call
yb_send_dmwithgroup_code,name(target user's name), andmessage - The tool automatically finds the user and sends the DM
- Report the result to the user
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 111 lines · 21 tokens per session scan D a9483b7e185e
yuanbao is a skill published in the GitHub repository NousResearch/hermes-agent (243,598 stars, last pushed yesterday), licensed MIT. It adds 21 tokens to every session and 1,027 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 3 findings (subtle steering, tells the agent never to refuse, strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
content-hash-cache-pattern
Cache expensive file processing results using SHA-256 content hashes — path-independent, auto-invalidating, with service layer separation.
keybindings-help
Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify /.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
fewer-permission-prompts
Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
rubyllm
Build and maintain Ruby or Rails applications with the RubyLLM AI framework. Use for chats, agents, tools, structured output, media generation, transcription, OCR, moderation, embeddings, reranking, Rails integration, and RubyLLM upgrades; not for contributing to the framework itself.
shogun-model-switch
A live-switching tool for changing which command-line AI agent, model, and reasoning mode is running. It updates settings, restarts the agent, and refreshes the displayed session information.
14-email-marketing
Dung khi can xay chuoi email hoac Zalo OA gui theo kich ban — welcome series, nurture, promotion, win-back: phan tep, luong automation, subject line, tan suat gui, A/B test va KPI open/click. Kich hoat khi user nhac 'email marketing', 'chuoi email tu dong', 'welcome email', 'email nurture', 'broadcast Zalo OA', 'co…