hermes-agent
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/install_hermes.shscript fetches the Hermes Agent source code from the official NousResearch GitHub repository (https://github.com/NousResearch/hermes-agent.git). This is a reputable source consistent with the skill's stated purpose. - [COMMAND_EXECUTION]: Shell scripts (
hermes_wrapper.sh,hermes_delegate.sh) wrap thehermesCLI for integration with AI agents. These scripts execute the local binary and manage process lifecycle (timeouts, locks) using standard bash patterns. - [SAFE]: Static analysis flagged destructive command strings in
references/config-guide.md. Technical review confirms these strings are part of adenied_commandsdenylist (e.g.,rm -rf /,sudo,chmod 777) intended to enhance the security of the agent's terminal tool. - [SAFE]: The skill implements a local telemetry mechanism in
scripts/hermes_delegate.shthat logs execution errors to~/.workbuddy/memory/self-improving/learnings.jsonl. This data is stored locally for the purpose of 'self-improving' agent logic and shows no signs of external exfiltration.
Audit Metadata