oh-my-hermes is an operating layer for Hermes Agent that organizes requests into workflows for planning, research, creation, coding handoffs, operations, and project memory. Hermes users run these workflows through the desktop app, CLI, or messenger app, while the catalogue add-ons extend its native capabilities.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rlaope/oh-my-hermes --skill omh-legal-compliance-reviewgit clone --depth 1 https://github.com/rlaope/oh-my-hermesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review)<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-legal-compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rlaope/oh-my-hermes/omh-legal-compliance-review"><img src="https://agentmods.dev/badge/skills/rlaope/oh-my-hermes/omh-legal-compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01445 |
| Opus 5.5 | $0.00029 | $0.00578 |
| Sonnet 5.5 | $0.00015 | $0.00289 |
| Haiku 4.5 | $0.00007 | $0.00145 |
Grade A, and why
omh-legal-compliance-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Legal Compliance Review
This is an OMH legal-compliance-review workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
Why This Exists
legal-compliance-review prepares scoped issues for human legal review without claiming counsel or filing authority.
Do Not Use When
- The user needs a final jurisdiction-specific legal opinion, legal representation, or authoritative filing decision; prepare the issue and counsel brief instead.
- The review is about code, secrets, permissions, prompt injection, dependencies, or unsafe tool behavior; use
omh-security-safety-review. - The request is a plain-language rewrite without a legal-risk review objective; use
omh-content-operator. - The user asks to sign, accept, submit, file, publish, or change a policy or contract in an external system; use
omh-appsonly after explicit authority. - Redact the PII in the file itself and scan it before sending it, once sharing it is cleared; use
omh-data-share-review.
Examples
Good example:
- Prompt: Review this vendor DPA for data-processing obligations, risky clauses, and questions for counsel.
- Expected behavior: Prepare an authority-bound issue matrix, ranked risks, and counsel questions.
- Why: The request needs a prepared review and escalation aid before a legal decision.
Bad example:
- Prompt: Audit this OAuth integration for secret and permission risks.
- Expected behavior: Route to
security-safety-review, notlegal-compliance-review. - Why: The target is technical security risk rather than contract or compliance analysis.
Completion Checklist
- Findings or no-issue results are grounded in concrete file, artifact, command, or source evidence.
- Open questions, residual risk, and missing verification are named.
- Fixes or follow-up work are separate handoffs unless the user explicitly asked to implement them.
Recovery Notes
- If the reviewed target is missing, inspect the requested artifact or ask one target question.
- If independent verification is unavailable, report the gap and avoid an approval-style claim.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines 30167b18ddff
- 14d ago Changed · +2 lines 3bc1b7921583
- 27d ago Changed · +3 lines ba4ad680bbc1
- 1mo ago Changed · +1 tokens per session 133a17d0d86b
- 1mo ago Changed · +10 tokens per session 049ca8113bf6
- 1mo ago Changed · +6 lines 20c1242de604
- 1mo ago Changed · +4 lines · -2 tokens per session 5af45e06f2c3
- 1mo ago Changed · -11 lines 4303648ab3d9
- 1mo ago Changed b20040f13862
- 1mo ago First seen · 128 lines · 64 tokens per session scan A ed3f1248ffd0
omh-legal-compliance-review is a skill published in the GitHub repository rlaope/oh-my-hermes (4,366 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 1,445 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
novel-compliance
A Chinese-language guide to content review and sensitive-word avoidance for web fiction platforms. It describes platform rules, common restricted topics, review processes, and ways to handle sensitive scenes.
comply
Regulatory compliance and audit agent. Maps business regulatory requirements (SOC2/PCI-DSS/HIPAA/ISO 27001), checks control implementations, designs audit trails, and implements Policy as Code. Use when compliance auditing is needed.
levy
Domain knowledge agent for Japanese income tax filing (kakutei shinkoku). Guides income classification, deduction optimization, tax calculation, and filing for freelancers, sole proprietors, and side-business earners. Does not write code.
information-security-manager-iso27001
Design or audit ISO 27001 ISMS controls, security risk treatment, and compliance evidence, including healthcare and medical-device contexts.
lark-approval
A skill for handling approval requests in Lark, such as leave, expenses, and other forms that move through a review process.
cloak
A privacy engineering guide for finding and reducing exposure of personal information in software. It covers data flows, consent, privacy regulations such as GDPR and CCPA, schemas, APIs, and logs.