command-reviewer

Reviews every terminal/execute_code call before execution: deterministic hard rules block credential reads and destructive patterns, script contents are ingested and judged (not just filenames), an LLM reviewer with an injection-resistant prompt issues SAFE/SUSPICIOUS/MALICIOUS verdicts, and operator approve/deny decisions are recorded content-hash-bound so an unchanged script is never re-asked. Disclosure - the reviewer reads the contents of script files referenced by reviewed commands and sends them to your configured LLM provider; it shells out to docker exec to read sandbox files when the in-process environment is unavailable; reviewer failures fail closed to a human approval prompt; nothing is auto-approved. Disclosure — reviews every terminal/execute_code call before it runs; reads the contents of script files the command names (inside the Docker sandbox via `docker exec` when available, otherwise from the host path) and sends them, with the command text, to your configured auxiliary LLM; keeps an audit log and a precedent database of your approval decisions under $HERMES_HOME/plugin-data/command-reviewer/ and reads config.yaml (read-only) to see whether you answered "Always" to one of its prompts; can only block or escalate to the approval prompt, never auto-approves; ships in shadow mode (log only) until you set `mode: enforce`.

spideysri2802Toolsv0.2.9Updated 3 hours ago

About

command-reviewer

Hermes executes shell commands and scripts on your behalf. A script written
earlier can be run later without anyone reading it, and a command that looks
harmless can do something harmful. Nothing between "the agent decided to run
this" and "it ran" checks whether the code is actually malicious.

command-reviewer closes that gap. A plugin hook reviews every
terminal and execute_code call before it runs: commands get checked by
deterministic rules and an LLM reviewer, and scripts get their contents
read and judged, not just their filenames. Malicious code is blocked.
Anything uncertain goes to you for approve/deny — and your decision is
remembered, bound to the exact bytes of the script, so you only judge a
command once.

Setup

Requires Hermes Agent v0.23+ (Docker terminal backend recommended).

Put plugin.yaml and __init__.py in ~/.hermes/plugins/command-reviewer/

Validate and enable:

hermes plugins doctor ~/.hermes/plugins/command-reviewer --ci
hermes plugins enable command-reviewer

It starts in shadow mode — logs every decision, blocks nothing:

tail -20 ~/.hermes/plugin-data/command-reviewer/decisions.jsonl

When you trust it, flip to enforce (live, no restart):

hermes config set plugins.entries.command-reviewer.settings.mode enforce

Model reviews use the command_reviewer auxiliary task, which follows your
main model (one small LLM call per reviewed command). Pin a cheaper model in
Desktop Settings → Models if you like.

License

MIT — see LICENSE.

README from the reviewed commit 5c07dcf; it updates when the author re-pins.

command-reviewer

About