Advisory SkillEvaluator scan
In addition to the built-in security scanner (which enforces the install policy above), Hermes can run NVIDIA SkillEvaluator Tier 1 checks on every hub install as a second opinion. Tier 1 is deterministic and keyless - PII detection (leaked emails, personal paths, connection strings), unicode-smuggling detection, script lint, license compliance, and a static security scan via NVIDIA SkillSpector . The scan is advisory only : findings are printed with file and line before the install confirmation, and the install continues. Findings that look like real credentials (private keys, cloud access keys, tokens, credentialed connection strings) are highlighted in red so you can review the flagged lines before deciding. PII-class findings are informational - the upstream scanner has known false-positive classes (e.g. git@github.com SSH syntax, documentation example emails), so they never block anything. To enable it, install the optional scanner binaries (the second one powers the security check; without it that check simply reports "not run"): Without the binary on PATH the scan is silently skipped. To turn it off entirely: The dashboard's Browse-hub scan button returns the same advisory d…
From the official Hermes Agent documentation.
uv tool install --python 3.13 \
"skillevaluator @ git+https://github.com/NVIDIA/SkillEvaluator.git@v0.1.0"
uv tool install "git+https://github.com/NVIDIA/SkillSpector.git@v2.9.5"