hermes-agent

Commit Graph

Author	SHA1	Message	Date
teknium1	1c9433897c	chore(skills): standards sweep — bring 42 bundled/optional skills up to hardline Audited all 191 in-repo skills (77 bundled, 114 optional) against the authoring standards (AGENTS.md hardline + PR #80800). Fixed 42: - 8 overlong descriptions rewritten to <= 60 chars, one sentence, period (one-three-one-rule 525ch, drug-discovery 405ch, web-pentest 358ch, fitness-nutrition 352ch, neuroskill-bci 332ch, oss-forensics 320ch, computer-use 307ch, memento-flashcards 252ch) - 24 skills with missing frontmatter fields: author (credited from git history: f-trycua, SHL0MS, teyrebaz33, haileymarshall, FurkanL0, teknium1), license, version, platforms, tags - 7 machine-local paths scrubbed (/home/bb, /home/user, /home/ubuntu -> portable placeholders) - 11 marketing-word intros reworded (Comprehensive/state-of-the-art) - docs catalogs + per-skill pages regenerated, scope-disciplined Deferred (not in this PR): - 14 frontmatter/dir name mismatches — open PR #42788 already proposes the dir-rename approach for 4 of them; resolve there as one class - 2 skills over 100k chars (pytorch-fsdp 159k, research-paper-writing 103k) — need content splits into references/, separate PRs - comfyui dangling related_skill resolves after the name-mismatch class	2026-08-08 15:27:29 -07:00
Teknium	2b48ba0249	fix: clean up SkillEvaluator Tier 1 security findings in bundled skills Findings from scanning skills/ + optional-skills/ with NVIDIA SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode smuggling, script lint): - pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal paths (use ~ / portable phrasing); pokemon-player no longer claims machine-specific state as fact - kanban-video-orchestrator: replace <path> angle-bracket token in frontmatter credits (flagged as XML-in-frontmatter prompt injection) - comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase placeholder secrets so they no longer pattern-match real credentials (your-* placeholder convention, comment markers, {env:...} form) - docker-management, pytorch-lightning: drop user:pass@ from example connection strings (env/secret-manager guidance instead) - evm: break up Keccak round constant that Luhn-validates as a credit card number (digit-group underscores, value unchanged) All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which retains scanner false positives only (Colab notebook IDs read as Bitcoin addresses; an email inside a quoted upstream system prompt).	2026-08-08 10:45:21 -07:00
Teknium	5aa798fecc	feat(skills): actual-setup optional skill + provider docs - optional-skills/devops/actual-setup: field-tested setup skill contributed by shl0ms, updated for the first-class 'actual' provider (the original targeted a custom-provider config that now collides with the built-in name) - docs: providers.md section + tables, environment-variables.md, quickstart.md - tests/skills: frontmatter + first-class-provider conformance checks	2026-08-05 14:08:32 -07:00

Author

SHA1

Message

Date

teknium1

1c9433897c

chore(skills): standards sweep — bring 42 bundled/optional skills up to hardline

Audited all 191 in-repo skills (77 bundled, 114 optional) against the
authoring standards (AGENTS.md hardline + PR #80800). Fixed 42:

- 8 overlong descriptions rewritten to <= 60 chars, one sentence, period
  (one-three-one-rule 525ch, drug-discovery 405ch, web-pentest 358ch,
  fitness-nutrition 352ch, neuroskill-bci 332ch, oss-forensics 320ch,
  computer-use 307ch, memento-flashcards 252ch)
- 24 skills with missing frontmatter fields: author (credited from git
  history: f-trycua, SHL0MS, teyrebaz33, haileymarshall, FurkanL0,
  teknium1), license, version, platforms, tags
- 7 machine-local paths scrubbed (/home/bb, /home/user, /home/ubuntu ->
  portable placeholders)
- 11 marketing-word intros reworded (Comprehensive/state-of-the-art)
- docs catalogs + per-skill pages regenerated, scope-disciplined

Deferred (not in this PR):
- 14 frontmatter/dir name mismatches — open PR #42788 already proposes
  the dir-rename approach for 4 of them; resolve there as one class
- 2 skills over 100k chars (pytorch-fsdp 159k, research-paper-writing
  103k) — need content splits into references/, separate PRs
- comfyui dangling related_skill resolves after the name-mismatch class

2026-08-08 15:27:29 -07:00

Teknium

2b48ba0249

fix: clean up SkillEvaluator Tier 1 security findings in bundled skills

Findings from scanning skills/ + optional-skills/ with NVIDIA
SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode
smuggling, script lint):

- pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal
  paths (use ~ / portable phrasing); pokemon-player no longer claims
  machine-specific state as fact
- kanban-video-orchestrator: replace <path> angle-bracket token in
  frontmatter credits (flagged as XML-in-frontmatter prompt injection)
- comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase
  placeholder secrets so they no longer pattern-match real credentials
  (your-* placeholder convention, comment markers, {env:...} form)
- docker-management, pytorch-lightning: drop user:pass@ from example
  connection strings (env/secret-manager guidance instead)
- evm: break up Keccak round constant that Luhn-validates as a credit
  card number (digit-group underscores, value unchanged)

All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which
retains scanner false positives only (Colab notebook IDs read as Bitcoin
addresses; an email inside a quoted upstream system prompt).

2026-08-08 10:45:21 -07:00

Teknium

5aa798fecc

feat(skills): actual-setup optional skill + provider docs

- optional-skills/devops/actual-setup: field-tested setup skill contributed
  by shl0ms, updated for the first-class 'actual' provider (the original
  targeted a custom-provider config that now collides with the built-in name)
- docs: providers.md section + tables, environment-variables.md, quickstart.md
- tests/skills: frontmatter + first-class-provider conformance checks

2026-08-05 14:08:32 -07:00

3 Commits