Skill Integrity
Rug-pull detection for installed agent skills — fingerprints every file in every skill directory (SHA-256), keeps a profile-local snapshot, and reports exactly which skill files changed, appeared, or vanished since; a skill that mutates after install without the user touching it is the rug-pull signal. A skill directory made unreadable is reported as a finding, never treated as clean. Read-only observer, stdlib-only, zero network calls; blind spots (oversize files, symlinks, permission-denied) are counted and printed, never silent. The wrapper registers an hourly pre_llm_call hook that injects findings into the agent context, plus a /skill-integrity slash command (snapshot | check | show) that creates the baseline snapshot and shows the file-level diff. The CLI supports --state-dir to target the plugin's manifest directly. Skill dirs and state derive from get_hermes_home(), covering non-default profiles.
Good to know before installing
Reads (hash-only, read-only) every file under the active profile's skills directory and ~/.claude/skills, stores a mode-0600 snapshot in HERMES_HOME/plugin-data/skill-integrity, and at most hourly injects the names of changed skills into the agent's context.
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install skill-integrity - Said no? Turn it on later:
hermes plugins enable skill-integrity - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Coding & developer tools
- Maintained by
- ZidoCode (Community)
- Needs
- No API keys declared
- Needs Hermes
- 0.21.6 or newer
- Version
- 0.2.1
- In the catalog
- 2026-10-16, updated 2026-10-18
Full setup & settings ↗Source code ↗
More in coding & developer tools
All coding & developer tools plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher