mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-04-25 00:51:20 +00:00
eed891f1bb
CI/CD Hardening:
- Pin all 12 GitHub Actions to full commit SHAs (was mutable @vN tags)
- Add explicit permissions: {contents: read} to 4 workflows
- Pin CI pip installs to exact versions (pyyaml==6.0.2, httpx==0.28.1)
- Extend supply-chain-audit.yml to scan workflow, Dockerfile, dependency
manifest, and Actions version changes
Dependency Pinning:
- Pin git-based Python deps to commit SHAs (atroposlib, tinker, yc-bench)
- Pin WhatsApp Baileys from mutable branch to commit SHA
Tool Registry:
- Reject tool name shadowing from different tool families (plugins/MCP
cannot overwrite built-in tools). MCP-to-MCP overwrites still allowed.
MCP Security:
- Add tool description content scanning for prompt injection patterns
- Log detailed change diff on dynamic tool refresh at WARNING level
Skill Manager:
- Fix dangerous verdict bug: agent-created skills with dangerous
findings were silently allowed (ask->None->allow). Now blocked.
16 lines
421 B
JSON
16 lines
421 B
JSON
{
|
|
"name": "hermes-whatsapp-bridge",
|
|
"version": "1.0.0",
|
|
"description": "WhatsApp bridge for Hermes Agent using Baileys",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"start": "node bridge.js"
|
|
},
|
|
"dependencies": {
|
|
"@whiskeysockets/baileys": "WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770",
|
|
"express": "^4.21.0",
|
|
"qrcode-terminal": "^0.12.0",
|
|
"pino": "^9.0.0"
|
|
}
|
|
}
|