Secret Drop
Store a secret on the gateway host without showing it to the model.
Good to know before installing
Stores the value in plaintext in the profile .env (mode 0600) and adds the name to terminal.env_passthrough, so $NAME is available to the terminal tool; the model can still read the value with its own tools (cat .env, echo $NAME). Keeps secrets out of chat/prompt context and redacts verbatim output of credential-shaped values; it is not a boundary against a model that deliberately reads it. Adds a static system-prompt section and a /secret command. Imports private core helpers read-only (_config_profile_scope, _is_hermes_provider_credential, _CONFIG_LOCK).
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install secret-drop - Said no? Turn it on later:
hermes plugins enable secret-drop - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Security & privacy · Hermes Desktop add-ons
- Maintained by
- Goitonthefloor (Community)
- Needs
- No API keys declared
- Version
- 1.4.0
- In the catalog
- 2026-09-26
Full setup & settings ↗Source code ↗
More in security & privacy
All security & privacy plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher