oh-my-hermes is an operating layer for Hermes Agent that organizes requests into workflows for planning, research, creation, coding handoffs, operations, and project memory. Hermes users run these workflows through the desktop app, CLI, or messenger app, while the catalogue add-ons extend its native capabilities.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rlaope/oh-my-hermes --skill omh-legal-compliance-reviewgit clone --depth 1 https://github.com/rlaope/oh-my-hermesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review)<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-legal-compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-legal-compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01241 |
| Opus 5 | $0.00032 | $0.00620 |
| Sonnet 5 | $0.00013 | $0.00248 |
| Haiku 4.5 | $0.00006 | $0.00124 |
Grade A, and why
omh-legal-compliance-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Legal Compliance Review
This is a Hermes-native legal-compliance-review workflow skill.
Why This Exists
legal-compliance-review prepares scoped issues for human legal review without claiming counsel or filing authority.
Do Not Use When
- The user needs a final jurisdiction-specific legal opinion, legal representation, or authoritative filing decision; prepare the issue and counsel brief instead.
- The review is about code, secrets, permissions, prompt injection, dependencies, or unsafe tool behavior; use
security-safety-review. - The request is a plain-language rewrite without a legal-risk review objective; use
content-operator. - The user asks to sign, accept, submit, file, publish, or change a policy or contract in an external system; use
connector-operatoronly after explicit authority.
Examples
Good example:
- Prompt: Review this vendor DPA for data-processing obligations, risky clauses, and questions for counsel.
- Expected behavior: Prepare an authority-bound issue matrix, ranked risks, and counsel questions.
- Why: The request needs a prepared review and escalation aid before a legal decision.
Bad example:
- Prompt: Audit this OAuth integration for secret and permission risks.
- Expected behavior: Route to
security-safety-review, notlegal-compliance-review. - Why: The target is technical security risk rather than contract or compliance analysis.
Completion Checklist
- Findings or no-issue results are grounded in concrete file, artifact, command, or source evidence.
- Open questions, residual risk, and missing verification are named.
- Fixes or follow-up work are separate handoffs unless the user explicitly asked to implement them.
Recovery Notes
- If the reviewed target is missing, inspect the requested artifact or ask one target question.
- If independent verification is unavailable, report the gap and avoid an approval-style claim.
Workflow Lane
- Current lane: Research and company ops (
product-docs,source-finder,web-research,research,best-practice-research,autoresearch-goal,model-optimization,inference-serving,+19 more) - research, signals, ops, and briefings. - If intent belongs to another lane, hand back to
oh-my-hermesor name the adjacent workflow. - Shared product, routing, compatibility, and evidence rules:
omh-routing/references/skill-common-rail.md.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed b20040f13862
- 7d ago Changed ed3f1248ffd0
- 9d ago Changed c2ca286a1f64
- 13d ago First seen · 128 lines · 64 tokens per session scan A 83c8ba65047a
omh-legal-compliance-review is a skill published in the GitHub repository rlaope/oh-my-hermes (1,677 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 1,241 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
novel-compliance
A Chinese-language guide to content review and sensitive-word avoidance for web fiction platforms. It describes platform rules, common restricted topics, review processes, and ways to handle sensitive scenes.
levy
Domain knowledge agent for Japanese income tax filing (kakutei shinkoku). Guides income classification, deduction optimization, tax calculation, and filing for freelancers, sole proprietors, and side-business earners. Does not write code.
comply
Regulatory compliance and audit agent. Maps business regulatory requirements (SOC2/PCI-DSS/HIPAA/ISO 27001), checks control implementations, designs audit trails, and implements Policy as Code. Use when compliance auditing is needed.
information-security-manager-iso27001
Design or audit ISO 27001 ISMS controls, security risk treatment, and compliance evidence, including healthcare and medical-device contexts.
lark-approval
A skill for handling approval requests in Lark, such as leave, expenses, and other forms that move through a review process.
cloak
A privacy engineering guide for finding and reducing exposure of personal information in software. It covers data flows, consent, privacy regulations such as GDPR and CCPA, schemas, APIs, and logs.