TarekkharsaThis plugin has no README in the catalog yet.
All plugins
canary-trap
Catch prompt injection by the secret it tries to steal. Every turn the agent is shown a decoy credential (HERMES_DEPLOY_KEY=hdk_live_…) with the instruction never to send it; no real task needs it, so if it shows up in a tool call — plain, URL-encoded, base64, hex, reversed, spaced out or as a 16+ character fragment, in any nested argument — the call is blocked (pre_tool_call), every later tool call in that session goes to your approval until /canary reset, and the reply opens with an alert (transform_llm_output). /canary shows status and incidents, rotates the decoy, or tests text. Disclosure — adds a ~60-token paragraph with the decoy to each turn's user message (pre_llm_call; Hermes may persist the API-bound message for cache replay; the decoy grants nothing). Stores in its own plugin state: the decoy, up to 200 incidents (time, tool name, how the decoy was hidden, platform, session id — never tool arguments or conversation content) and locked session ids. Lockdown only adds approval prompts through Hermes' approval gate (auto-approved under YOLO, so advisory there; the leaking call is always blocked). No network, subprocesses, tools, credentials, telemetry or background work.
About
Catch prompt injection by the secret it tries to steal. Every turn the agent is shown a decoy credential (HERMES_DEPLOY_KEY=hdk_live_…) with the instruction never to send it; no real task needs it, so if it shows up in a tool call — plain, URL-encoded, base64, hex, reversed, spaced out or as a 16+ character fragment, in any nested argument — the call is blocked (pre_tool_call), every later tool call in that session goes to your approval until /canary reset, and the reply opens with an alert (transform_llm_output). /canary shows status and incidents, rotates the decoy, or tests text. Disclosure — adds a ~60-token paragraph with the decoy to each turn's user message (pre_llm_call; Hermes may persist the API-bound message for cache replay; the decoy grants nothing). Stores in its own plugin state: the decoy, up to 200 incidents (time, tool name, how the decoy was hidden, platform, session id — never tool arguments or conversation content) and locked session ids. Lockdown only adds approval prompts through Hermes' approval gate (auto-approved under YOLO, so advisory there; the leaking call is always blocked). No network, subprocesses, tools, credentials, telemetry or background work.
More by Tarekkharsa
2 plugins by Tarekkharsa in the catalog.
