All plugins

secure-env-ingress

One-use HTTPS forms for missing environment secrets, native encrypted Browser Vault logins/TOTP setup keys and payment cards, retained exact-parent login/password and saved TOTP filling, protected payment-field filling, nested verification codes/passcodes and guarded indexed code groups, and approved secret operations outside chat and LLM input. Disclosure — /senv setup supplies a skill using sudo for host packages and TLS setup after approval; the TLS listener binds all interfaces by default; pre_gateway_dispatch observes gateway messages to bind commands to their sender. Interactive Telegram secret entry uses secure_env_vault; secure_login_fill consumes existing native Vault handles without registering a login backend. Browser writes require an explicitly selected existing parent and the public captured-CDP dispatch API, retain the original transport and exact document/control guards, and fail closed on reconnect, profile or human-control lease changes; tab creation ownership is not required. No native fill fallback or explicit site-form submission occurs. Payment filling requires separate native consent; explicit resume requires existing nonempty values to match Vault. Card storage includes encrypted CVC. Site input callbacks, especially 3-D Secure, may authorize or auto-submit an operation. Unknown outcomes require external verification before retry. secure_operation executes administrator-allowlisted, SHA-256-pinned external Python consumers with gateway privileges; consumers are trusted, not sandboxed, and none are enabled by default. Secret input is not persisted by this mode; consumers must enforce their own handling policy. Links are bearer authorization, not submitter identity; cancellation cannot stop an already-running consumer. Setup bootstrap reads the profile .env directly to obtain TELEGRAM_ALLOWED_USERS owner IDs.

web3blindToolsv0.8.3Updated 7 days ago

About

One-use HTTPS forms for missing environment secrets, native encrypted Browser Vault logins/TOTP setup keys and payment cards, retained exact-parent login/password and saved TOTP filling, protected payment-field filling, nested verification codes/passcodes and guarded indexed code groups, and approved secret operations outside chat and LLM input. Disclosure — /senv setup supplies a skill using sudo for host packages and TLS setup after approval; the TLS listener binds all interfaces by default; pre_gateway_dispatch observes gateway messages to bind commands to their sender. Interactive Telegram secret entry uses secure_env_vault; secure_login_fill consumes existing native Vault handles without registering a login backend. Browser writes require an explicitly selected existing parent and the public captured-CDP dispatch API, retain the original transport and exact document/control guards, and fail closed on reconnect, profile or human-control lease changes; tab creation ownership is not required. No native fill fallback or explicit site-form submission occurs. Payment filling requires separate native consent; explicit resume requires existing nonempty values to match Vault. Card storage includes encrypted CVC. Site input callbacks, especially 3-D Secure, may authorize or auto-submit an operation. Unknown outcomes require external verification before retry. secure_operation executes administrator-allowlisted, SHA-256-pinned external Python consumers with gateway privileges; consumers are trusted, not sandboxed, and none are enabled by default. Secret input is not persisted by this mode; consumers must enforce their own handling policy. Links are bearer authorization, not submitter identity; cancellation cannot stop an already-running consumer. Setup bootstrap reads the profile .env directly to obtain TELEGRAM_ALLOWED_USERS owner IDs.

Secure Env Ingress

Platform-independent, profile-scoped HTTPS forms for adding missing dotenv variables from Hermes messaging gateways. /senv name KEY1,KEY2 defines a form; /senv name reopens it; /senv status, /senv cancel, and /senv setup provide readiness, invalidation and installation assistance. Never put values in chat. Form values travel browser → HTTPS → add-only target, not through the agent.

This is the runtime-only catalog distribution, without privileged certificate installers. Python 3.11+, Linux/POSIX and trusted IP-address TLS material are required. Registration uses the normalized pre_gateway_dispatch hook plus the generic plugin slash command; no Telegram-specific handler is installed. Set allowed_owners: {discord: ["exact-opaque-user-id"]} for platform-specific owners, or keep legacy allowed_telegram_user_ids: [123456789] for Telegram. Chat allowlists alone do not grant ownership. Ordinary browser forms need no Telegram token; Telegram Mini App launch is unavailable through this generic command path.

Bearer-link warning: the one-use HTTPS URL is returned to the originating chat. Anyone who reads the link can use it. Send /senv only in private or operator-trusted groups/threads, never in public or untrusted rooms. Never forward or log links. If the agent is busy, the host may queue, steer, interrupt or interpret the command; wait for completion or use /stop first, then send a fresh /senv. Do not assume busy commands avoid the model. A missing plugin cannot protect values already pasted into chat.

/senv setup sends a fixed installation-only request using the host's existing injection permission, or supplies copyable ordinary-message text when injection is denied. Privileged changes need separate approval. No listener starts on import; TLS, target binding and owner authorization are checked before issuing a capability. Existing keys are never overwritten.

Retained login/password and saved TOTP (0.8.3)

List the native Vault first; handles and public identifiers are metadata, not secrets. Reuse a matching login. Type the public username separately before binding, including username-first flows. Then use the plugin route, not stock native fill:

{"handle":"vault_example","parent":"EXACT_EXISTING_SELECTED_PAGE_ID","origin":"https://example.com","mode":"login"}

This is secure_login_fill, distinct from storage-only secure_env_vault. It accepts no password, code, endpoint or executable JS. Ordinary passwords use the native login classifier, never transient-code semantics; a unique current-password field is retained across top-level, bounded nested/OOPIF and open/closed custom Shadow documents. Password-only pages are supported. Optional field_selector and login-only original frame are discovery descriptors, not setter destinations. Ambiguous forms refuse; identifiers are not forced into a new page.

For a saved authenticator key, call the same secure_login_fill with mode:"totp". The native backend's metadata origin/allowed_origins must match the retained exact OTP document before resolve_otp (and before resolve_password for login). A wrong-origin handle never resolves a secret or invokes a setter. TOTP uses the existing retained OTP guard, not native enter_code; absent stored code refuses and must not fall back to an unbound prompt. Standalone human-entered codes still use secure_env_vault(mode="code",parent=...).

Dynamic LOGIN support is deliberately bounded. Synchronous handlers may reflect the exact selected password value, update supported validation/state classes and enable the same-form submit button; controlled React passwords and the retained public input-updater transaction are covered. Original account values (including restored changes observed at beforeinput/input/change boundaries), controls, form association/action and selected iframe visibility/inert ancestry remain guarded. Arbitrary or asynchronous name/type/class changes, unsafe or scoped CSS dependencies and unsupported reconciliation still refuse rather than redirecting a secret.

Locked/unavailable manager providers refuse without resolver access. Unlock only with the native supported unlock flow and its surface constraints, then start a new exact-parent request; this plugin never bypasses an unavailable prompt. Metadata is rechecked before secret resolution. Redaction is registered before secret dispatch, and results contain only fixed outcomes/metadata. Navigation, clone/reparent, form action changes, focus redirection, cancellation/expiry, reconnect and profile/human-lease epoch changes refuse. Each setter targets the original retained control after focus validation; no retry, recapture, native fallback or form submission occurs. Sites may act on input. An unknown result may be partial and must not be retried automatically. This is not a browser-wide atomicity or compromised-right-origin-script guarantee.

See the full setup, security boundaries and test instructions. Administrative helpers are separately reviewed operator tools, not catalog contents. Never run privileged helpers from a runtime-user-writable checkout.

README from the reviewed commit a6c3062; it updates when the author re-pins.

More by web3blind

4 plugins by web3blind in the catalog.

web3blindvk-platformVK Messenger gateway with community Long Poll, media attachments, allowlists, and project-lane routing.Communityplatform1web3blindchrome-tab-watchdogConservative Chrome tab cleanup with in-process observation and browser-call leases. Disclosure — runs a background thread inside Hermes that proxies your local Chrome DevTools port (127.0.0.1:9222 → 127.0.0.1:9223, loopback only, you must point browser.cdp_url at it), injects a focus/activity listener into every Chrome page, rewrites browser_exec session names to a per-profile namespace, and a cron script you schedule auto-closes idle, duplicate and blank tabs (including tabs with unsaved text).Communityautomationweb3blinddeferred-questionsDurable non-blocking questions with exact answer binding and gateway continuation. Disclosure — pre_gateway_dispatch sees gateway messages, accepts answers only from the stored recipient and route, and may consume recognized stale/completed inputs; with enable_tool on, the model can send questions to any chat the gateway already authorizes, and continue_agent resumes the target chat with the answer; questions and answers are stored unencrypted in $HERMES_HOME/deferred-questions/questions.sqlite3; profile-local Unix-socket notices wake event-driven workers; pre_llm_call/on_session_end observe current input, turn IDs and terminal status to correlate technical completion for payload retirement, not business success or delivery; automatic header-only repair preserves originals in quarantine, and text-free receipts retain caller-supplied idempotency keys and request hashes; private gateway and adapter APIs can break after a Hermes update.Communityautomation