Some people install apps. Hermes Agent installs whole skills. And after months of treating the open internet like an all-you-can-eat buffet with no dress code, it has finally hired a bouncer.
NVIDIA SkillEvaluator Tier 1 advisory scanning quietly shipped inside the August release window (v0.20.4, tagged August 18). From now on, every community skill you pull down gets a license check and a security scan before it is allowed anywhere near your machine. Your self-growing AI just learned that not everything on GitHub belongs on your hard drive.
Why Your Agent Needed a Doorman
Hermes Agent's whole identity is that it grows with you. You teach it, it builds skills, and it reaches out to a sprawling ecosystem of open repositories to pull in new capabilities. That flexibility is the feature. It is also, historically, the security model. Fear not, said nobody.
Consider what actually happens when you install a skill. That skill is a bundle of instructions and code, and Hermes runs it right next to your terminals, your paid model keys, and your cron jobs. A stranger's repo asking for that kind of access used to be greeted with a smile and zero questions. The old vetting process was a shrug. The new one is a checklist.
Here is what the scanning now checks before a skill gets the green light:
- License: is the thing actually licensed for you to run, or was it lifted from somewhere it should not have been?
- Security: a Tier 1 advisory pass that flags the red flags before your agent follows untrusted instructions with your credentials in its pocket.
- Attribution: whether the repo is really maintained by the person claiming to maintain it, or by hopes and a matching username.
Score One for Skepticism
This is the boring kind of update that never gets a flashy launch video, and for exactly that reason it might be the most important thing Hermes shipped all summer. Every agentic tool now leans on a fast-growing marketplace of third-party plugins and skills, and supply chain attacks have become the frontier of AI security.
Checking IDs at the door, at install time, is the move that nobody claps for and that quietly prevents a very bad Tuesday.
One honest caveat: the scanning is advisory, not a jail. Tier 1 means it flags and advises, not that your agent will point a flashlight in your eyes and forbid the transaction. Think of it as a bouncer who checks your ID and then frowns at you suspiciously, not one who calls the cops. You are still welcome to install that clearly cursed skill and find out what happens. Bless your heart.
A Glow-Up Along the Way
The same release window gave Hermes Desktop a proper makeover right alongside the new security muscle: frosted-glass and translucency surfaces with matte finish options, a frost picker, and macOS preselections, plus a tabbed SESSIONS|BOTS sidebar so your growing bot collection is easier to wrangle. So yes, the bouncer arrived wearing nicer clothes.
If you were running Hermes earlier this summer and never bothered to update, go run hermes update. Your agent now looks like it belongs on a design magazine cover and, more importantly, it checks its friends' references before letting them into the house. Growth, but make it credentialed.
Comments