Install
$ agentstack add skill-atlasomnia-donna-starter-hermes-plugin-evaluation ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Hermes Plugin Evaluation
Use this when the user asks about installing, trusting, pricing, or using a third-party Hermes Agent plugin or integration.
Goal
Give a practical go/no-go read before touching the live Hermes gateway. Separate:
- Plugin code cost/license — whether the repository itself is public/open-source/free to install.
- Service cost — required SaaS account, usage billing, phone/SMS/voice costs, model API costs, tunnels, hosted routing, or paid feature gates.
- Operational risk — what data leaves Hermes, whether the plugin opens public webhooks/tunnels, and whether it modifies gateway behavior.
Fast evaluation workflow
- Load authoritative Hermes context first when the task involves Hermes plugins:
- Load
hermes-agentif available. - Prefer official Hermes docs for CLI syntax and plugin lifecycle.
- Inspect the repository without installing it:
- README / docs
plugin.yamlpyproject.toml,package.json, lockfilesLICENSE,NOTICE, or equivalent- setup wizard files and
after-installnotes - tool definitions, platform adapter files, webhook/tunnel code
- Answer cost precisely:
- Say “plugin appears free/public” only for the repo/installable code.
- Do not infer the hosted service is free just because the plugin is public.
- Identify paid dependencies: phone numbers, SMS/MMS, voice minutes, hosted tunnels, OpenAI/Anthropic/etc. APIs, storage, or managed accounts.
- Check for a public pricing page, but treat absence as unknown, not free:
- If pricing is missing/404/gated, say “pricing not publicly obvious; confirm with vendor.”
- Report required credentials and data paths:
- Required env vars/API keys.
- Optional credentials that change cost or data flow.
- Whether inbound messages/calls pass through vendor infrastructure.
- Recommend a safe rollout:
- Test in a non-critical Hermes profile or disabled gateway first.
- Avoid putting it on the main gateway until pricing, credentials, and data flow are understood.
- Run plugin-specific
doctor/diagnostics before enabling public channels.
Response shape the user prefers
Keep it concise and decisive:
- Short answer first: free, paid, mixed, or unclear.
- What I verified as bullets.
- Cost implication as bullets.
- Recommended next step if installation/security matters.
Avoid broad explanations of Hermes unless he asks. He usually wants the practical answer.
Pitfalls
- Public repo ≠ free service. Many plugins are just glue to a paid platform.
- No LICENSE file means unclear license, even if GitHub visibility is public.
- Phone/SMS/voice are rarely free at scale. Assume carrier/service costs unless docs explicitly say otherwise.
- Hosted tunnels/webhooks imply external data flow. Flag this before installation.
- Do not install first just to answer pricing/trust questions. Inspect first, then ask/confirm before side effects.
- — condensed findings from evaluating
inkbox-ai/hermes-agent-pluginfor cost, setup requirements, and data-flow implications.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: AtlasOmnia
- Source: AtlasOmnia/donna-starter
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.