What is hermes-security-review?

A security review checklist for Hermes settings, permissions, and connected extensions. It checks who can control the agent, what it can run, and how secrets may be exposed.

Use it before deployment, after adding plugins or MCP servers, or on a regular schedule to report risks and suggested fixes.

It helps find unsafe settings before exposing Hermes to other people, messaging platforms, or outside extensions.

hermes-security-review — Skill for Claude Code and Codex by OnlyTerp

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add OnlyTerp/hermes-optimization-guide --skill hermes-security-review

Clone the repo

git clone --depth 1 https://github.com/OnlyTerp/hermes-optimization-guide

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/onlyterp/hermes-optimization-guide/hermes-security-review/github.svg)](https://agentmods.dev/skills/onlyterp/hermes-optimization-guide/hermes-security-review)

Your own site

<a href="https://agentmods.dev/skills/onlyterp/hermes-optimization-guide/hermes-security-review"><img src="https://agentmods.dev/badge/skills/onlyterp/hermes-optimization-guide/hermes-security-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/onlyterp/hermes-optimization-guide/hermes-security-review"><img src="https://agentmods.dev/badge/skills/onlyterp/hermes-optimization-guide/hermes-security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 12 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,050 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00012	$0.01050
Opus 5.5	$0.00005	$0.00420
Sonnet 5.5	$0.00002	$0.00210
Haiku 4.5	$0.00001	$0.00105

Measured 21d ago against content hash bc6359cce27e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

hermes-security-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

6. **Report** findings by severity with the exact fix for each: `hermes config set …`, `chmod 600 …`, an allowlist line, or `hermes pairing revoke …`. Ask which to apply.

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

skills/hermes-security-review/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Hermes Security Review

Check the settings that decide who can drive this agent, what it may run, and what it can leak. Then report risks by severity, each with a concrete fix.

When to Use

Before exposing Hermes on a messaging platform, to other people, or on a server.
After adding MCP servers, plugins, or skills from outside sources.
As a monthly cron job.

Procedure

Run commands with the terminal tool. Never print secret values. Read key names only. Change nothing without the user's approval.

Approval and safety settings:

hermes config get approvals.mode
hermes config get approvals.cron_mode
hermes config get approvals.unattended_mode
hermes config get security.redact_secrets
hermes config get security.protected_instruction_files
hermes config get security.protected_instruction_extra_patterns
hermes config get memory.write_approval
hermes config get skills.write_approval
hermes config get security.allow_private_urls
hermes config get gateway.allow_all_users
hermes config get terminal.backend
hermes config get auth.adopt_external_logins

Secrets file permissions. Expect 600:

ENV_FILE="$(hermes config env-path)"
stat -c '%a' "$ENV_FILE" 2>/dev/null || stat -f '%Lp' "$ENV_FILE"

Who can talk to it. List allowlist-related key names in the secrets file, without values, plus pending pairings:
```
grep -oE '^[A-Z_]*(ALLOWED_USERS|ALLOWED_CHATS|ALLOW_ALL_USERS)=' "$(hermes config env-path)"
hermes pairing list
hermes gateway status
```
For each platform the gateway runs, confirm that an allowlist or DM pairing is in place.

Supply chain:

hermes security audit      # OSV.dev scan of the venv, plugin deps, pinned MCP servers
hermes skills audit        # re-scan hub-installed skills
hermes plugins list --user
hermes mcp list

Rate what you found:

Severity	Condition
Critical	`gateway.allow_all_users: true` or any `*_ALLOW_ALL_USERS=true` on a profile with terminal access. `approvals.mode: off` on a profile reachable from messaging.
High	Secrets file readable by other users (not `600`). A platform running with no allowlist and no pairing. `security.redact_secrets: false`. Known vulnerabilities from `hermes security audit`.
Medium	`approvals.cron_mode` or `approvals.unattended_mode` not `deny`. `security.protected_instruction_files: false`. MCP servers from unknown publishers with broad tool access and no include filter.
Low	`security.allow_private_urls: true` on a machine with sensitive internal services. `auth.adopt_external_logins: true` where Codex CLI or Claude Code logins should stay separate. `security.protected_instruction_extra_patterns` missing `.hermes.md`, `agents.override.md` or `*.mdc` on a profile that works in repos other people wrote. `memory.write_approval` or `skills.write_approval` off on a profile other people can message.

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

21d ago First seen · 93 lines · 12 tokens per session scan A bc6359cce27e

Subscribe to this mod's changes

hermes-security-review is a skill published in the GitHub repository OnlyTerp/hermes-optimization-guide (696 stars, last pushed 22d ago), licensed MIT. It adds 12 tokens to every session and 1,050 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.

Security

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens

hermes-security-review