hermes-agent/skills
Teknium e402906d48
fix: five HERMES_HOME profile-isolation leaks (#10570)
* fix: show correct env var name in provider API key error (#9506)

The error message for missing provider API keys dynamically built
the env var name as PROVIDER_API_KEY (e.g. ALIBABA_API_KEY), but
some providers use different names (alibaba uses DASHSCOPE_API_KEY).
Users following the error message set the wrong variable.

Fix: look up the actual env var from PROVIDER_REGISTRY before
building the error. Falls back to the dynamic name if the registry
lookup fails.

Closes #9506

* fix: five HERMES_HOME profile-isolation leaks (#5947)

Bug A: Thread session_title from session_db to memory provider init kwargs
so honcho can derive chat-scoped session keys instead of falling back to
cwd-based naming that merges all gateway users into one session.

Bug B: Replace 14 hardcoded ~/.hermes/skills/ paths across 10 skill files
with HERMES_HOME-aware alternatives (${HERMES_HOME:-$HOME/.hermes} in
shell, os.environ.get('HERMES_HOME', ...) in Python).

Bug C: install.sh now respects HERMES_HOME env var and adds --hermes-home
flag. Previously --dir only set INSTALL_DIR while HERMES_HOME was always
hardcoded to $HOME/.hermes.

Bug D: Remove hardcoded ~/.hermes/honcho.json fallback in resolve_config_path().
Non-default profiles no longer silently inherit the default profile's honcho
config. Falls through to ~/.honcho/config.json (global) instead.

Bug E: Guard _edit_skill, _patch_skill, _delete_skill, _write_file, and
_remove_file against writing to skills found in external_dirs. Skills
outside the local SKILLS_DIR are now read-only from the agent's perspective.

Closes #5947
2026-04-15 17:09:41 -07:00
..
apple feat: secure skill env setup on load (core #688) 2026-03-13 03:14:04 -07:00
autonomous-ai-agents fix: five HERMES_HOME profile-isolation leaks (#10570) 2026-04-15 17:09:41 -07:00
creative feat: add architecture-diagram skill (Cocoon AI port) (#9906) 2026-04-14 16:10:18 -07:00
data-science feat: restore ACP server implementation from PR #949 (#1254) 2026-03-14 00:09:05 -07:00
devops/webhook-subscriptions feat(webhook): hermes webhook CLI + skill for event-driven subscriptions (#3578) 2026-03-28 14:33:35 -07:00
diagramming refactor: reorganize skills into sub-categories 2026-03-09 03:35:53 -07:00
dogfood refactor: remove browser_close tool — auto-cleanup handles it (#5792) 2026-04-07 03:28:44 -07:00
domain refactor: reorganize skills into sub-categories 2026-03-09 03:35:53 -07:00
email feat: secure skill env setup on load (core #688) 2026-03-13 03:14:04 -07:00
feeds refactor: reorganize skills into sub-categories 2026-03-09 03:35:53 -07:00
gaming feat: add pokemon-player skill with battle-tested gameplay tips 2026-03-09 20:29:38 -07:00
gifs refactor: reorganize skills into sub-categories 2026-03-09 03:35:53 -07:00
github fix: five HERMES_HOME profile-isolation leaks (#10570) 2026-04-15 17:09:41 -07:00
index-cache Release set of skills 2026-02-25 05:21:17 -08:00
inference-sh feat(gateway): skill-aware slash commands, paginated /commands, Telegram 100-cap (#3934) 2026-03-30 10:57:30 -07:00
leisure/find-nearby fix(skills): use is None check for coordinates in find-nearby to avoid dropping valid 0.0 values 2026-04-15 03:45:09 -07:00
mcp feat: secure skill env setup on load (core #688) 2026-03-13 03:14:04 -07:00
media docs: improve youtube-content skill structure and workflow 2026-04-03 22:18:00 -07:00
mlops refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821) 2026-04-07 10:25:31 -07:00
note-taking refactor: update Obsidian vault path handling 2026-02-25 20:24:51 -08:00
productivity fix: five HERMES_HOME profile-isolation leaks (#10570) 2026-04-15 17:09:41 -07:00
red-teaming/godmode fix: five HERMES_HOME profile-isolation leaks (#10570) 2026-04-15 17:09:41 -07:00
research docs: restore Orchestra Research attribution in research-paper-writing skill (#8800) 2026-04-12 22:03:18 -07:00
smart-home feat: secure skill env setup on load (core #688) 2026-03-13 03:14:04 -07:00
social-media feat(skills): add X/Twitter xitter skill via upstream x-cli (#1285) 2026-03-14 04:00:27 -07:00
software-development refactor(skills): consolidate code verification skills into one (#4854) 2026-04-03 14:13:27 -07:00