Install-time security scanning
Every hermes plugins install and hermes plugins update runs a static security scan over the plugin tree before it is activated (inspired by Claude Cowork's skill & plugin security scanning). The scanner reuses the same threat-pattern engine as the Skills Hub guard - exfiltration of credential stores, reverse shells, destructive commands, persistence mechanisms, obfuscated execution, and prompt injection in documentation files - with plugin-aware exemptions: a provider plugin reading its own API key from the environment (the documented requires_env pattern) is not flagged. Three verdicts, matching Cowork's pass/warn/fail: Verdict Behavior safe Installs normally, no extra output caution Findings are shown; you confirm Install anyway? [y/N] (or pass --force ) dangerous Blocked. --force does not override On hermes plugins update , a dangerous verdict on the updated tree disables the plugin until you review the findings and re-enable it. A dangerous block names the critical findings that caused it (e.g. 1 critical of 42 findings (destructive_root_rm) ), so a single blocking line is not hidden behind the total. Text that cannot run on the host at install time is scored as context , not a…
From the official Hermes Agent documentation.
plugins:
scan_on_install: false