oh-my-hermes is an operating layer for Hermes Agent that organizes requests into workflows for planning, research, creation, coding handoffs, operations, and project memory. Hermes users run these workflows through the desktop app, CLI, or messenger app, while the catalogue add-ons extend its native capabilities.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rlaope/oh-my-hermes --skill omh-data-share-reviewgit clone --depth 1 https://github.com/rlaope/oh-my-hermesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-data-share-review)<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-data-share-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-data-share-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-data-share-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-data-share-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.02442 |
| Opus 5.5 | $0.00042 | $0.00977 |
| Sonnet 5.5 | $0.00021 | $0.00488 |
| Haiku 4.5 | $0.00011 | $0.00244 |
Grade A, and why
omh-data-share-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Share Review
This is an OMH data-share-review workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
Why This Exists
data-share-review exists because data leaving the team had no owner: Hermes redacts identifiers in gateway chat and secrets in tool output, omh-security-safety-review reviews an agent's own exposure, and omh-legal-compliance-review reads the obligations, while nothing minimized a file's fields, kept its pseudonym mapping local, and refused to call it redacted before a scan of what actually leaves.
First Steps
- Ask where the file goes and what the destination needs it for before touching a field.
- Inventory the fields from the header and the schema before planning any masking.
Do Not Use When
- Whether the data may lawfully leave at all -- the lawful basis, a DPA, consent, or a cross-border transfer -- is a contract and compliance question; use
omh-legal-compliance-review, then return here for the fields. - The exposure is an agent's tool permissions, a secret in code, or a prompt-injection path rather than a file about to leave; use
omh-security-safety-review. - The ask is analysing the dataset itself -- trends, a cleanup, a chart; use
omh-data-analysis. - Filing the issue once its attachment is clean -- the title, labels, and reproduction steps; use
omh-github-issue-intake. - Building the training set or deciding whether to train once the corpus is clean; use
omh-model-finetuning. - Working the support queue -- triaging or answering tickets rather than exporting them; use
omh-support-operations.
Examples
Good example:
- Prompt: the analytics vendor wants last month's ticket export, take the customer details out first
- Expected behavior: Ask what the vendor needs, inventory the columns from the header and per-column shape counts, drop the ones it does not need, pseudonymize the customer id with the mapping kept in a local folder, count emails, phone numbers, names, and secrets in the output with a scan that prints counts only, and write the share record.
- Why: A masking step that was never followed by a scan of the shipped file has not shown that anything came out.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 3a0ee571ce42
- 2d ago Changed a49ec2a3bf83
- 3d ago First seen · 139 lines · 106 tokens per session scan A ed7555891be8
omh-data-share-review is a skill published in the GitHub repository rlaope/oh-my-hermes (3,392 stars, last pushed today), licensed MIT. It adds 106 tokens to every session and 2,442 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
novel-compliance
A Chinese-language guide to content review and sensitive-word avoidance for web fiction platforms. It describes platform rules, common restricted topics, review processes, and ways to handle sensitive scenes.
comply
Regulatory compliance and audit agent. Maps business regulatory requirements (SOC2/PCI-DSS/HIPAA/ISO 27001), checks control implementations, designs audit trails, and implements Policy as Code. Use when compliance auditing is needed.
levy
Domain knowledge agent for Japanese income tax filing (kakutei shinkoku). Guides income classification, deduction optimization, tax calculation, and filing for freelancers, sole proprietors, and side-business earners. Does not write code.
information-security-manager-iso27001
Design or audit ISO 27001 ISMS controls, security risk treatment, and compliance evidence, including healthcare and medical-device contexts.
lark-approval
A skill for handling approval requests in Lark, such as leave, expenses, and other forms that move through a review process.
cloak
A privacy engineering guide for finding and reducing exposure of personal information in software. It covers data flows, consent, privacy regulations such as GDPR and CCPA, schemas, APIs, and logs.