What it adds
Hooks 3
pre_tool_callpost_tool_calltransform_tool_resultCheck every terminal command with your installed tirith before it runs: lookalike and homograph URLs, pipe-to-shell, obfuscated execution, credential and .env exfiltration, malicious packages and terminal injection. tirith blocks and required policy approvals go to Hermes's approval prompt, critical findings are refused, warnings run with the warning added to the result; unattended runs follow approvals.*_mode.
hermes plugins install tirithpre_tool_callpost_tool_calltransform_tool_result