Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-17-hermes-agent-plugin-install-and-update-now-security-scan-the-tree-before-it-can
Plugin install and update now security-scan the tree before it can run.
hermes plugins install and hermes plugins update previously cloned and activated arbitrary git repos completely unscanned -- and plugins run Python in-process with the agent, with full access to its environment, making them a more dangerous surface than the hub skills Hermes already scanned. A new tools/plugin_guard.py runs the existing skills_guard threat-pattern engine over the temp clone before it is moved into ~/.hermes/plugins/, and re-scans after hermes plugins update. Verdicts: safe installs silently, caution prints findings and requires Install anyway? [y/N] or --force, dangerous is blocked and --force does not override. The plugin adaptation exempts the requires_env pattern on code files (plugins legitimately read their own API keys) while still enforcing it on docs and config files where it reads as an injection or social-engineering signal; foreign credential-store access (~/.ssh, ~/.aws, ~/.hermes/.env), reverse shells, destructive commands, persistence, obfuscated execution and symlink escapes stay at full strength. On by default, opt out via plugins.scan_on_install: false. A false-positive audit over all 60 bundled plugins returned 57 safe, 3 caution, 0 dangerous. The PR credits Claude Cowork's skill and plugin scanning as the inspiration and tabulates how the two policies differ -- notably Cowork's is off by default as an Enterprise setting where Hermes ships it on.
Channel: tagged-release. Ancestry: merge_commit_sha 9d139320d46b2e6f1df52f06eccdd37ff323efb7; compare/9d139320...v2026.8.16.2 -> status=ahead, ahead_by=140, behind_by=0 (ancestor of stable tag v2026.8.16.2).
Operator consequence: You get this on upgrade with no action. Do check plugins.scan_on_install is not disabled in a config you inherited, and re-run hermes plugins update across anything you installed before v0.20.3 -- those trees were never scanned. Note the scanner is static pattern matching, not an LLM review: it catches shapes, not intent.
Receipt
Finding metadata
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
Finding ID: 2026-08-17-hermes-agent-plugin-install-and-update-now-security-scan-the-tree-before-it-can
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact