Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-10-hermes-agent-profile-export-import-ships-a-whole-setup-including-unscrubbed-secrets
Profile export/import ships a whole setup -- including unscrubbed secrets in skills and SOUL.md.
/export and /import (CLI, TUI, REST, and desktop) package a profile as a shareable .tar.gz containing config.yaml, SOUL.md, MEMORY.md, USER.md, system_prompt.md, AGENTS.md, CLAUDE.md, .cursorrules, todo.json and the full unfiltered skills tree. The PR states plainly: credentials files (auth.json, .env) are stripped, but there is 'no content-level PII/secret scrub of skills, memories, sessions, or persona files.'
Channel: tagged-release. Ancestry: merge_commit_sha 0a48af25bb22d569d84d35ba4d73f4934a5943ec; GET repos/NousResearch/hermes-agent/compare/0a48af25...v2026.8.13 -> status=ahead, ahead_by=1478, behind_by=0, i.e. the commit is an ancestor of the stable tag v2026.8.13.
Operator consequence: If you shared a profile archive built from a Hermes between 2026-08-04 and 2026-08-10, assume any API key pasted into a skill, memory, or SOUL.md left the machine. Rotate those credentials and re-export on v0.20.1 or later, where the scrub exists (see the companion entry).
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-hermes-agent-profile-export-import-ships-a-whole-setup-including-unscrubbed-secrets
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact