The agent that grows with you
41759 matches across 21 categories. Click a row to expand file-level details.
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | hermes_constants.py | 386 | # ─── Well-Known Paths ───────────────────────────────────────────────────────── |
| MEDIUM | hermes_constants.py | 409 | # ─── Network Preferences ───────────────────────────────────────────────────── |
| MEDIUM | hermes_constants.py | 454 | # ─── Streaming Response Constants ──────────────────────────────────────────── |
| MEDIUM | setup-hermes.sh | 2 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 4 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 18 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 269 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 270 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 272 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 62 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 64 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 129 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 131 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 165 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 167 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 187 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 189 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 325 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 327 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 344 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 346 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 398 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 400 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 417 | # ============================================================================ |
| MEDIUM | setup-hermes.sh | 419 | # ============================================================================ |
| MEDIUM | run_agent.py | 185 | # ========================================================================= |
| MEDIUM | run_agent.py | 187 | # ========================================================================= |
| MEDIUM | run_agent.py | 190 | # ========================================================================= |
| MEDIUM | run_agent.py | 194 | # ========================================================================= |
| MEDIUM | run_agent.py | 771 | # ── Buffered retry/fallback status ──────────────────────────────────── |
| MEDIUM | run_agent.py | 1318 | # ------------------------------------------------------------------ |
| MEDIUM | run_agent.py | 1320 | # ------------------------------------------------------------------ |
| MEDIUM | run_agent.py | 3375 | # ── Unified streaming API call ───────────────────────────────────────── |
| MEDIUM | run_agent.py | 3553 | # ── Per-turn primary restoration ───────────────────────────────────── |
| MEDIUM | toolsets.py | 340 | # ========================================================================== |
| MEDIUM | toolsets.py | 345 | # ========================================================================== |
| MEDIUM | hermes_logging.py | 68 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 70 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 86 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 88 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 122 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 124 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 152 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 154 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 294 | # --------------------------------------------------------------------------- |
| MEDIUM | hermes_logging.py | 296 | # --------------------------------------------------------------------------- |
| MEDIUM | mini_swe_runner.py | 64 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 66 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 113 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 115 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 153 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 155 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 632 | # ============================================================================ |
| MEDIUM | mini_swe_runner.py | 634 | # ============================================================================ |
| MEDIUM | cli.py | 970 | # ============================================================================= |
| MEDIUM | cli.py | 972 | # ============================================================================= |
| MEDIUM | cli.py | 1461 | # ============================================================================ |
| MEDIUM | cli.py | 1463 | # ============================================================================ |
| MEDIUM | cli.py | 2103 | # --------------------------------------------------------------------------- |
| MEDIUM | cli.py | 2105 | # --------------------------------------------------------------------------- |
| 8766 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | batch_runner.py | 101 | def _normalize_tool_error_counts(tool_error_counts: Dict[str, int]) -> Dict[str, int]: |
| LOW | batch_runner.py | 732 | def _scan_completed_prompts_by_content(self) -> set: |
| LOW | batch_runner.py | 776 | def _filter_dataset_by_completed(self, completed_prompts: set) -> Tuple[List[Dict], List[int]]: |
| LOW | hermes_constants.py | 30 | def reset_hermes_home_override(token: Token) -> None: |
| LOW | toolset_distributions.py | 247 | def sample_toolsets_from_distribution(distribution_name: str) -> List[str]: |
| LOW | run_agent.py | 848 | def _disable_codex_reasoning_replay( |
| LOW | run_agent.py | 1328 | def _summarize_background_review_actions( |
| LOW | run_agent.py | 2110 | def _format_file_mutation_failure_footer(failed: Dict[str, Dict[str, Any]]) -> str: |
| LOW | run_agent.py | 2169 | def _format_turn_completion_explanation(turn_exit_reason: str) -> str: |
| LOW | run_agent.py | 2902 | def _replace_primary_openai_client(self, *, reason: str) -> bool: |
| LOW | run_agent.py | 3418 | def _record_streamed_assistant_text(self, text: str) -> None: |
| LOW | run_agent.py | 3426 | def _normalize_interim_visible_text(text: str) -> str: |
| LOW | run_agent.py | 3431 | def _interim_content_was_streamed(self, content: str) -> bool: |
| LOW | run_agent.py | 4249 | def _copy_reasoning_content_for_api(self, source_msg: dict, api_msg: dict) -> None: |
| LOW | run_agent.py | 4254 | def _reapply_reasoning_echo_for_provider(self, api_messages: list) -> int: |
| LOW | run_agent.py | 4260 | def _sanitize_tool_calls_for_strict_api(api_msg: dict) -> dict: |
| LOW | run_agent.py | 207 | def _pool_may_recover_from_rate_limit( |
| LOW | run_agent.py | 456 | def _get_session_db_for_recall(self): |
| LOW | run_agent.py | 497 | def _transition_context_engine_session( |
| LOW | run_agent.py | 618 | def _ensure_lmstudio_runtime_loaded(self, config_context_length: Optional[int] = None) -> None: |
| LOW | run_agent.py | 701 | def _should_start_quiet_spinner(self) -> bool: |
| LOW | run_agent.py | 720 | def _should_emit_quiet_tool_messages(self) -> bool: |
| LOW | run_agent.py | 891 | def _stream_diag_capture_response( |
| LOW | run_agent.py | 904 | def _is_provider_stream_parse_error(self, error: BaseException) -> bool: |
| LOW | run_agent.py | 976 | def _check_compression_model_feasibility(self) -> None: |
| LOW | run_agent.py | 981 | def _replay_compression_warning(self) -> None: |
| LOW | run_agent.py | 1022 | def _resolved_api_call_timeout(self) -> float: |
| LOW | run_agent.py | 1042 | def _resolved_api_call_stale_timeout_base(self) -> tuple[float, bool]: |
| LOW | run_agent.py | 1070 | def _compute_non_stream_stale_timeout(self, api_payload: Any) -> float: |
| LOW | run_agent.py | 1147 | def _anthropic_prompt_cache_policy( |
| LOW | run_agent.py | 1160 | def _model_requires_responses_api(model: str) -> bool: |
| LOW | run_agent.py | 1175 | def _provider_model_requires_responses_api( |
| LOW | run_agent.py | 1209 | def _has_content_after_think_block(self, content: str) -> bool: |
| LOW | run_agent.py | 1238 | def _has_natural_response_ending(content: str) -> bool: |
| LOW | run_agent.py | 1267 | def _should_treat_stop_as_truncated( |
| LOW | run_agent.py | 1298 | def _looks_like_codex_intermediate_ack( |
| LOW | run_agent.py | 1360 | def _build_memory_write_metadata( |
| LOW | run_agent.py | 1378 | def _apply_persist_user_message_override(self, messages: List[Dict]) -> None: |
| LOW | run_agent.py | 1407 | def _drop_trailing_empty_response_scaffolding(self, messages: List[Dict]) -> None: |
| LOW | run_agent.py | 1465 | def _flush_messages_to_session_db(self, messages: List[Dict], conversation_history: List[Dict] = None): |
| LOW | run_agent.py | 1524 | def _get_messages_up_to_last_assistant(self, messages: List[Dict]) -> List[Dict]: |
| LOW | run_agent.py | 1555 | def _format_tools_for_system_message(self) -> str: |
| LOW | run_agent.py | 1560 | def _convert_to_trajectory_format(self, messages: List[Dict[str, Any]], user_query: str, completed: bool) -> List[Di |
| LOW | run_agent.py | 1732 | def _extract_api_error_context(error: Exception) -> Dict[str, Any]: |
| LOW | run_agent.py | 1737 | def _usage_summary_for_api_request_hook(self, response: Any) -> Optional[Dict[str, Any]]: |
| LOW | run_agent.py | 2043 | def _record_file_mutation_result( |
| LOW | run_agent.py | 2082 | def _file_mutation_verifier_enabled(self) -> bool: |
| LOW | run_agent.py | 2141 | def _turn_completion_explainer_enabled(self) -> bool: |
| LOW | run_agent.py | 2261 | def _apply_pending_steer_to_tool_results(self, messages: list, num_tool_msgs: int) -> None: |
| LOW | run_agent.py | 2311 | def _check_openrouter_cache_status(self, http_response: Any) -> None: |
| LOW | run_agent.py | 2403 | def _sync_external_memory_for_turn( |
| LOW | run_agent.py | 2606 | def _build_system_prompt_parts(self, system_message: str = None) -> Dict[str, str]: |
| LOW | run_agent.py | 2624 | def _get_tool_call_name_static(tc) -> str: |
| LOW | run_agent.py | 2649 | def _is_thinking_only_assistant(msg: Dict[str, Any]) -> bool: |
| LOW | run_agent.py | 2703 | def _drop_thinking_only_and_merge_users( |
| LOW | run_agent.py | 2764 | def _invalidate_system_prompt(self): |
| LOW | run_agent.py | 2784 | def _derive_responses_function_call_id( |
| LOW | run_agent.py | 2843 | def _build_keepalive_http_client(base_url: str = "") -> Any: |
| LOW | run_agent.py | 2919 | def _ensure_primary_openai_client(self, *, reason: str) -> Any: |
| LOW | run_agent.py | 2935 | def _cleanup_dead_connections(self) -> bool: |
| 23977 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | batch_runner.py | 299 | except Exception as img_err: |
| LOW | batch_runner.py | 381 | except Exception as e: |
| LOW | batch_runner.py | 706 | except Exception as e: |
| LOW | batch_runner.py | 771 | except Exception as e: |
| LOW | batch_runner.py | 978 | except Exception as ckpt_err: |
| LOW | batch_runner.py | 981 | except Exception as e: |
| LOW | batch_runner.py | 1012 | except Exception as ckpt_err: |
| LOW | batch_runner.py | 1281 | except Exception as e: |
| LOW | batch_runner.py | 1312 | except Exception as e: |
| LOW | hermes_constants.py | 98 | except Exception: |
| LOW | hermes_constants.py | 350 | except Exception: |
| LOW | run_agent.py | 763 | except Exception: |
| LOW | run_agent.py | 768 | except Exception: |
| LOW | run_agent.py | 843 | except Exception: |
| LOW | run_agent.py | 845 | except Exception: |
| LOW | run_agent.py | 2100 | except Exception: |
| LOW | run_agent.py | 2105 | except Exception: |
| LOW | run_agent.py | 2159 | except Exception: |
| LOW | run_agent.py | 2164 | except Exception: |
| LOW | run_agent.py | 2362 | except Exception: |
| LOW | run_agent.py | 2366 | except Exception: |
| LOW | run_agent.py | 2375 | except Exception: |
| LOW | run_agent.py | 2486 | except Exception: |
| LOW | run_agent.py | 2490 | except Exception: |
| LOW | run_agent.py | 2492 | except Exception: |
| LOW | run_agent.py | 2501 | except Exception: |
| LOW | run_agent.py | 2523 | except Exception: |
| LOW | run_agent.py | 2529 | except Exception: |
| LOW | run_agent.py | 2535 | except Exception: |
| LOW | run_agent.py | 2546 | except Exception: |
| LOW | run_agent.py | 2548 | except Exception: |
| LOW | run_agent.py | 2557 | except Exception: |
| LOW | run_agent.py | 2893 | except Exception as exc: |
| LOW | run_agent.py | 2907 | except Exception as exc: |
| LOW | run_agent.py | 3413 | except Exception: |
| LOW | run_agent.py | 471 | except Exception as exc: |
| LOW | run_agent.py | 490 | except Exception as e: |
| LOW | run_agent.py | 523 | except Exception as exc: |
| LOW | run_agent.py | 529 | except Exception as exc: |
| LOW | run_agent.py | 552 | except Exception as exc: |
| LOW | run_agent.py | 563 | except Exception as exc: |
| LOW | run_agent.py | 648 | except Exception as err: |
| LOW | run_agent.py | 746 | except Exception: |
| LOW | run_agent.py | 751 | except Exception: |
| LOW | run_agent.py | 798 | except Exception: |
| LOW | run_agent.py | 810 | except Exception: |
| LOW | run_agent.py | 819 | except Exception: |
| LOW | run_agent.py | 959 | except Exception: |
| LOW | run_agent.py | 1190 | except Exception: |
| LOW | run_agent.py | 1521 | except Exception as e: |
| LOW | run_agent.py | 1830 | except Exception: |
| LOW | run_agent.py | 1862 | except Exception: |
| LOW | run_agent.py | 1885 | except Exception as e: |
| LOW | run_agent.py | 1945 | except Exception: |
| LOW | run_agent.py | 1953 | except Exception as e: |
| LOW | run_agent.py | 1980 | except Exception: |
| LOW | run_agent.py | 2281 | except Exception: |
| LOW | run_agent.py | 2304 | except Exception: |
| LOW | run_agent.py | 2330 | except Exception: |
| LOW | run_agent.py | 2386 | except Exception: |
| 4956 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | cli.py | 10869 | "Fallback: pkg install python-numpy portaudio && python -m pip install sounddevice" |
| HIGH | cli.py | 10874 | "Option 2: pkg install python-numpy portaudio && python -m pip install sounddevice" |
| HIGH | cli.py | 11202 | _cprint(f" {_BOLD}Option 2: pkg install python-numpy portaudio && python -m pip install sounddevice |
| HIGH | tools/schema_sanitizer.py | 140 | {"anyOf": [{"type": "string"}, {"type": "null"}], "default": null} |
| HIGH | tools/voice_mode.py | 57 | return "pkg install python-numpy portaudio && python -m pip install sounddevice" |
| HIGH | tools/voice_mode.py | 138 | " 3. Verify with: arecord -d 3 /tmp/test.wav && aplay /tmp/test.wav" |
| HIGH | tools/process_registry.py | 788 | f"kill -0 \"$(cat {quoted_pid_path} 2>/dev/null)\" 2>/dev/null; echo $?", |
| HIGH | tools/browser_tool.py | 597 | return "npm install -g agent-browser && agent-browser install" |
| HIGH | tools/browser_tool.py | 598 | return "npm install -g agent-browser && agent-browser install --with-deps" |
| HIGH | tools/terminal_tool.py | 589 | """Wrap `A && B &` (or `A || B &`) to `A && { B & }` at depth 0. |
| HIGH | tools/terminal_tool.py | 589 | """Wrap `A && B &` (or `A || B &`) to `A && { B & }` at depth 0. |
| HIGH | tools/terminal_tool.py | 591 | Bash parses ``A && B &`` with `&&` tighter than `&`, so it forks a |
| HIGH | tools/terminal_tool.py | 592 | subshell for the whole `A && B` compound and backgrounds it. Inside |
| HIGH | tools/browser_supervisor.py | 88 | xhr.open("GET", ENDPOINT + "?" + params.toString(), false); // sync |
| HIGH | tools/browser_supervisor.py | 89 | xhr.send(null); |
| HIGH | tools/browser_supervisor.py | 90 | if (xhr.status !== 200) return null; |
| HIGH | tools/browser_supervisor.py | 93 | try { parsed = JSON.parse(body); } catch (e) { return null; } |
| HIGH | tools/browser_supervisor.py | 94 | if (kind === "alert") return undefined; |
| HIGH | tools/browser_supervisor.py | 95 | if (kind === "confirm") return Boolean(parsed && parsed.accept); |
| HIGH | tools/browser_supervisor.py | 97 | if (!parsed || !parsed.accept) return null; |
| HIGH | tools/browser_supervisor.py | 100 | return null; |
| HIGH | tools/browser_supervisor.py | 104 | return null; |
| HIGH | tools/browser_camofox.py | 14 | git clone https://github.com/jo-inc/camofox-browser && cd camofox-browser |
| HIGH | tools/browser_camofox.py | 15 | npm install && npm start # downloads Camoufox (~300MB) on first run |
| HIGH | tools/file_operations.py | 1612 | check = self._exec(f"test -e {self._escape_shell_arg(path)} && echo exists || echo not_found") |
| HIGH | tools/file_operations.py | 1620 | f"test -d {self._escape_shell_arg(parent)} && echo yes || echo no" |
| HIGH | tools/file_operations.py | 647 | result = self._exec(f"command -v {cmd} >/dev/null 2>&1 && echo 'yes'") |
| HIGH | tools/code_execution_tool.py | 752 | f"ls -1 {quoted_rpc_dir}/req_* 2>/dev/null || true", |
| HIGH | tools/code_execution_tool.py | 908 | "command -v python3 >/dev/null 2>&1 && echo OK", |
| HIGH | tools/environments/local.py | 431 | prelude_parts.append(f"[ -r '{safe}' ] && . '{safe}' 2>/dev/null || true") |
| HIGH | tools/environments/modal.py | 113 | "RUN rm -rf /usr/local/lib/python*/site-packages/pip* 2>/dev/null; " |
| HIGH | tools/environments/modal.py | 114 | "python -m ensurepip --upgrade --default-pip 2>/dev/null || true", |
| HIGH | tools/environments/modal.py | 118 | "RUN apt-get update -qq && apt-get install -y -qq python3 python3-venv > /dev/null 2>&1 || true" |
| HIGH | tools/environments/modal.py | 118 | "RUN apt-get update -qq && apt-get install -y -qq python3 python3-venv > /dev/null 2>&1 || true" |
| HIGH | tools/environments/base.py | 379 | f"builtin cd {_quoted_cwd} 2>/dev/null || true\n" |
| HIGH | tools/environments/base.py | 380 | f"pwd -P > {_quoted_cwd_file} 2>/dev/null || true\n" |
| HIGH | tools/environments/base.py | 439 | f"source {_quoted_snap} >/dev/null 2>&1 || true" |
| HIGH | tools/environments/base.py | 454 | parts.append(f"export -p > {_quoted_snap} 2>/dev/null || true") |
| HIGH | tools/environments/base.py | 457 | parts.append(f"pwd -P > {_quoted_cwd_file} 2>/dev/null || true") |
| HIGH | hermes_cli/models.py | 723 | # "paidRecommendedCompactionModel": {modelName, ...} | null, |
| HIGH | hermes_cli/models.py | 724 | # "paidRecommendedVisionModel": {modelName, ...} | null, |
| HIGH | hermes_cli/models.py | 725 | # "freeRecommendedCompactionModel": {modelName, ...} | null, |
| HIGH | hermes_cli/models.py | 726 | # "freeRecommendedVisionModel": {modelName, ...} | null, |
| HIGH | hermes_cli/models.py | 852 | # paid tier → paid, then free (if paid field is null) |
| HIGH | hermes_cli/models.py | 828 | Returns ``None`` when every candidate is missing, null, or the fetch |
| HIGH | hermes_cli/completion.py | 108 | profiles="$profiles $(ls "$profiles_dir" 2>/dev/null)" |
| HIGH | hermes_cli/completion.py | 209 | profiles+=("${{(@f)$(ls $HOME/.hermes/profiles 2>/dev/null)}}") |
| HIGH | hermes_cli/service_manager.py | 676 | f'chown -R hermes:hermes "$log_dir" 2>/dev/null || true\n' |
| HIGH | hermes_cli/web_server.py | 3831 | {"error": "Frontend not built. Run: cd web && npm run build"}, |
| HIGH | hermes_cli/tools_config.py | 788 | _print_warning(f" npm install failed - run manually: cd {display_hermes_home()}/hermes-agent && npm i |
| HIGH | hermes_cli/main.py | 1307 | f'source "{helper}" >&2 && ensure_node >&2 && command -v node', |
| HIGH | hermes_cli/main.py | 6683 | _say("Install Node.js, then run: cd web && npm install && npm run build") |
| HIGH | hermes_cli/main.py | 6710 | _say(" Run manually: cd web && npm install && npm run build") |
| HIGH | hermes_cli/main.py | 6751 | _say(" Run manually: cd web && npm install && npm run build") |
| HIGH | hermes_cli/main.py | 9172 | f" Try manually: git fetch origin && git reset --hard origin/{branch}" |
| HIGH | hermes_cli/main.py | 9214 | print(f" cd {PROJECT_ROOT} && git reflog && git reset --hard <prev-sha>") |
| HIGH | hermes_cli/main.py | 10925 | print(" Pre-build first: cd web && npm install && npm run build") |
| HIGH | hermes_cli/main.py | 14152 | "where npm may not be available. Pre-build with: cd web && npm run build" |
| HIGH | hermes_cli/doctor.py | 1090 | f"Reinstall entry point: cd {PROJECT_ROOT} && source venv/bin/activate && pip install -e '.[all]'" |
| HIGH | hermes_cli/doctor.py | 1274 | check_info("Install it manually later with: npm install -g agent-browser && agent-browser install") |
| 114 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | batch_runner.py | 26 | |
| LOW | hermes_bootstrap.py | 50 | |
| LOW | run_agent.py | 72 | |
| LOW | run_agent.py | 72 | |
| LOW | run_agent.py | 77 | |
| LOW | run_agent.py | 97 | |
| LOW | run_agent.py | 97 | |
| LOW | run_agent.py | 97 | |
| LOW | run_agent.py | 112 | |
| LOW | run_agent.py | 118 | |
| LOW | run_agent.py | 119 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 120 | |
| LOW | run_agent.py | 128 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 129 | |
| LOW | run_agent.py | 142 | |
| LOW | run_agent.py | 161 | |
| LOW | run_agent.py | 161 | |
| LOW | run_agent.py | 161 | |
| LOW | run_agent.py | 161 | |
| LOW | run_agent.py | 161 | |
| LOW | run_agent.py | 26 | |
| LOW | run_agent.py | 883 | |
| LOW | run_agent.py | 1321 | |
| LOW | run_agent.py | 1321 | |
| LOW | run_agent.py | 1321 | |
| LOW | setup.py | 1 | |
| LOW | cli.py | 18 | |
| LOW | mcp_serve.py | 30 | |
| LOW | tools/schema_sanitizer.py | 31 | |
| LOW | tools/tool_search.py | 28 | |
| LOW | tools/web_tools.py | 45 | |
| LOW | tools/web_tools.py | 53 | |
| LOW | tools/web_tools.py | 53 | |
| LOW | tools/web_tools.py | 63 | |
| LOW | tools/web_tools.py | 63 | |
| LOW | tools/web_tools.py | 63 | |
| LOW | tools/web_tools.py | 71 | |
| LOW | tools/web_tools.py | 71 | |
| LOW | tools/web_tools.py | 75 | |
| LOW | tools/web_tools.py | 94 | |
| LOW | tools/web_tools.py | 94 | |
| LOW | tools/web_tools.py | 94 | |
| LOW | tools/web_tools.py | 99 | |
| LOW | tools/web_tools.py | 99 | |
| LOW | tools/web_tools.py | 99 | |
| 1008 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | batch_runner.py | 125 | |
| LOW | batch_runner.py | 244 | |
| LOW | batch_runner.py | 642 | |
| LOW | batch_runner.py | 732 | |
| LOW | batch_runner.py | 776 | |
| LOW | batch_runner.py | 810 | |
| LOW | run_agent.py | 4493 | |
| LOW | run_agent.py | 822 | |
| LOW | run_agent.py | 1465 | |
| LOW | run_agent.py | 1775 | |
| LOW | run_agent.py | 1804 | |
| LOW | run_agent.py | 2457 | |
| LOW | run_agent.py | 2649 | |
| LOW | run_agent.py | 3242 | |
| LOW | run_agent.py | 3377 | |
| LOW | run_agent.py | 3867 | |
| LOW | run_agent.py | 3979 | |
| LOW | run_agent.py | 4012 | |
| LOW | run_agent.py | 4134 | |
| LOW | toolsets.py | 606 | |
| LOW | mini_swe_runner.py | 636 | |
| LOW | mini_swe_runner.py | 304 | |
| LOW | mini_swe_runner.py | 414 | |
| LOW | cli.py | 118 | |
| LOW | cli.py | 335 | |
| LOW | cli.py | 1037 | |
| LOW | cli.py | 1249 | |
| LOW | cli.py | 1596 | |
| LOW | cli.py | 1965 | |
| LOW | cli.py | 2173 | |
| LOW | cli.py | 2373 | |
| LOW | cli.py | 2486 | |
| LOW | cli.py | 15057 | |
| LOW | cli.py | 2907 | |
| LOW | cli.py | 3385 | |
| LOW | cli.py | 3823 | |
| LOW | cli.py | 3932 | |
| LOW | cli.py | 4088 | |
| LOW | cli.py | 4255 | |
| LOW | cli.py | 4629 | |
| LOW | cli.py | 4856 | |
| LOW | cli.py | 5240 | |
| LOW | cli.py | 5443 | |
| LOW | cli.py | 5550 | |
| LOW | cli.py | 5811 | |
| LOW | cli.py | 5877 | |
| LOW | cli.py | 6429 | |
| LOW | cli.py | 7200 | |
| LOW | cli.py | 7583 | |
| LOW | cli.py | 7976 | |
| LOW | cli.py | 8021 | |
| LOW | cli.py | 8371 | |
| LOW | cli.py | 9079 | |
| LOW | cli.py | 9460 | |
| LOW | cli.py | 9947 | |
| LOW | cli.py | 10273 | |
| LOW | cli.py | 10742 | |
| LOW | cli.py | 10973 | |
| LOW | cli.py | 11091 | |
| LOW | cli.py | 11143 | |
| 1214 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | plugins/platforms/discord/adapter.py | 0 | check if message reactions are enabled via config/env. |
| HIGH | gateway/platforms/telegram.py | 0 | check if message reactions are enabled via config/env. |
| HIGH | gateway/platforms/slack.py | 0 | check if message reactions are enabled via config/env. |
| HIGH | plugins/platforms/discord/adapter.py | 0 | plugin entry point — called by the hermes plugin system. |
| HIGH | plugins/platforms/teams/adapter.py | 0 | plugin entry point — called by the hermes plugin system. |
| HIGH | plugins/platforms/mattermost/adapter.py | 0 | plugin entry point — called by the hermes plugin system. |
| HIGH | …bsite/docs/developer-guide/adding-platform-adapters.md | 0 | plugin entry point — called by the hermes plugin system. |
| HIGH | plugins/platforms/ntfy/adapter.py | 0 | plugin entry point — called by the hermes plugin system at startup. |
| HIGH | plugins/platforms/simplex/adapter.py | 0 | plugin entry point — called by the hermes plugin system at startup. |
| HIGH | plugins/platforms/line/adapter.py | 0 | plugin entry point — called by the hermes plugin system at startup. |
| HIGH | plugins/memory/holographic/retrieval.py | 0 | select fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at, hrr_vector |
| HIGH | plugins/memory/holographic/retrieval.py | 0 | select fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at, hrr_vector |
| HIGH | plugins/memory/holographic/retrieval.py | 0 | select fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at, hrr_vector |
| HIGH | plugins/memory/holographic/retrieval.py | 0 | select fact_id, content, category, tags, trust_score, retrieval_count, helpful_count, created_at, updated_at, hrr_vector |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | curl -x post https://api.example.com/users \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" \ |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -x post https://api.example.com/users \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" \ |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -x post https://api.example.com/users \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" \ |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | curl -x post https://api.example.com/graphql \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -x post https://api.example.com/graphql \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -x post https://api.example.com/graphql \\ -h 'content-type: application/json' \\ -h "authorization: bearer $token" |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import os, requests resp = requests.post( "https://api.example.com/graphql", json={"query": "{ user(id: 1) { name email |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import os, requests resp = requests.post( "https://api.example.com/graphql", json={"query": "{ user(id: 1) { name email |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import os, requests resp = requests.post( "https://api.example.com/graphql", json={"query": "{ user(id: 1) { name email |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import requests resp = requests.get( "https://api.example.com/users/1", headers={"authorization": "bearer <token>"}, tim |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.get( "https://api.example.com/users/1", headers={"authorization": "bearer <token>"}, tim |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.get( "https://api.example.com/users/1", headers={"authorization": "bearer <token>"}, tim |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | curl -w "dns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s ttfb:%{time_starttransfer}s total:%{ti |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -w "dns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s ttfb:%{time_starttransfer}s total:%{ti |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -w "dns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s ttfb:%{time_starttransfer}s total:%{ti |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import requests from requests.exceptions import connecttimeout, readtimeout try: requests.get(url, timeout=(3.05, 30)) e |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests from requests.exceptions import connecttimeout, readtimeout try: requests.get(url, timeout=(3.05, 30)) e |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests from requests.exceptions import connecttimeout, readtimeout try: requests.get(url, timeout=(3.05, 30)) e |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import json, base64, os tok = os.environ["token"] payload = tok.split(".")[1] payload += "=" * (-len(payload) % 4) print |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import json, base64, os tok = os.environ["token"] payload = tok.split(".")[1] payload += "=" * (-len(payload) % 4) print |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import json, base64, os tok = os.environ["token"] payload = tok.split(".")[1] payload += "=" * (-len(payload) % 4) print |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | curl -v -x post https://api.example.com/endpoint \\ -h 'content-type: application/json' \\ -d '{"key":"value"}' 2>&1 |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -v -x post https://api.example.com/endpoint \\ -h 'content-type: application/json' \\ -d '{"key":"value"}' 2>&1 |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | curl -v -x post https://api.example.com/endpoint \\ -h 'content-type: application/json' \\ -d '{"key":"value"}' 2>&1 |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import requests resp = requests.post(url, json=payload, timeout=10) print(f"status={resp.status_code}") print(f"headers= |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.post(url, json=payload, timeout=10) print(f"status={resp.status_code}") print(f"headers= |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.post(url, json=payload, timeout=10) print(f"status={resp.status_code}") print(f"headers= |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import time, requests def with_backoff(method, url, **kwargs): for attempt in range(5): resp = requests.request(method, |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import time, requests def with_backoff(method, url, **kwargs): for attempt in range(5): resp = requests.request(method, |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import time, requests def with_backoff(method, url, **kwargs): for attempt in range(5): resp = requests.request(method, |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import requests def validate_user(data: dict) -> list[str]: errors = [] required = {"id": int, "email": str, "created_at |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests def validate_user(data: dict) -> list[str]: errors = [] required = {"id": int, "email": str, "created_at |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests def validate_user(data: dict) -> list[str]: errors = [] required = {"id": int, "email": str, "created_at |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | import requests resp = requests.post(url, json=payload, headers=headers, timeout=10) request_id = ( resp.headers.get("x- |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.post(url, json=payload, headers=headers, timeout=10) request_id = ( resp.headers.get("x- |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | import requests resp = requests.post(url, json=payload, headers=headers, timeout=10) request_id = ( resp.headers.get("x- |
| HIGH | …kills/software-development/rest-graphql-debug/SKILL.md | 0 | follow the rest-graphql-debug skill (optional-skills/software-development/rest-graphql-debug). base url: https://api.exa |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | follow the rest-graphql-debug skill (optional-skills/software-development/rest-graphql-debug). base url: https://api.exa |
| HIGH | …development/software-development-rest-graphql-debug.md | 0 | follow the rest-graphql-debug skill (optional-skills/software-development/rest-graphql-debug). base url: https://api.exa |
| HIGH | optional-skills/mlops/guidance/SKILL.md | 0 | { "name": <gen name regex="[a-za-z ]+" max_tokens=20>, "age": <gen age regex="[0-9]+" max_tokens=3>, "email": <gen email |
| HIGH | …ocs/user-guide/skills/optional/mlops/mlops-guidance.md | 0 | { "name": <gen name regex="[a-za-z ]+" max_tokens=20>, "age": <gen age regex="[0-9]+" max_tokens=3>, "email": <gen email |
| HIGH | …ent/user-guide/skills/optional/mlops/mlops-guidance.md | 0 | { "name": <gen name regex="[a-za-z ]+" max_tokens=20>, "age": <gen age regex="[0-9]+" max_tokens=3>, "email": <gen email |
| HIGH | optional-skills/mlops/training/trl-fine-tuning/SKILL.md | 0 | compute rewards for completions. args: completions: list of generated texts returns: list of reward scores (floats) |
| HIGH | …kills/optional/mlops/mlops-training-trl-fine-tuning.md | 0 | compute rewards for completions. args: completions: list of generated texts returns: list of reward scores (floats) |
| HIGH | …kills/optional/mlops/mlops-training-trl-fine-tuning.md | 0 | compute rewards for completions. args: completions: list of generated texts returns: list of reward scores (floats) |
| HIGH | optional-skills/mlops/inference/outlines/SKILL.md | 0 | apple inc. was founded in 1976 in the technology industry. the company employs approximately 164,000 people worldwide. |
| 88 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | docker-compose.windows.yml | 1 | # |
| LOW | setup-hermes.sh | 1 | #!/bin/bash |
| LOW | setup-hermes.sh | 241 | # (the direct deps in pyproject.toml are exact-pinned, but |
| LOW | .hadolint.yaml | 1 | # hadolint configuration for the Hermes Agent Dockerfile. |
| LOW | .hadolint.yaml | 21 | - DL3003 |
| LOW | hermes_bootstrap.py | 81 | os.environ.setdefault("PYTHONIOENCODING", "utf-8") |
| LOW | run_agent.py | 41 | import os |
| LOW | run_agent.py | 1921 | self._interrupt_thread_signal_pending = False |
| LOW | run_agent.py | 3041 | from agent.codex_runtime import run_codex_create_stream_fallback |
| LOW | pyproject.toml | 21 | # captured by `mistralai>=2.3.0,<3` rather than an exact pin, every |
| LOW | pyproject.toml | 41 | "ruamel.yaml==0.18.17", |
| LOW | pyproject.toml | 61 | # Cross-platform process / PID management. `psutil` is the canonical |
| LOW | pyproject.toml | 121 | # Computer use — macOS background desktop control via cua-driver (MCP stdio). |
| LOW | pyproject.toml | 161 | google = [ |
| LOW | pyproject.toml | 181 | all = [ |
| LOW | cli.py | 1501 | # to remap "near-white" skin colors (e.g. #FFF8DC banner_text, #B8860B |
| LOW | cli.py | 2061 | except Exception: |
| LOW | cli.py | 3221 | self._interrupt_queue = queue.Queue() |
| LOW | cli.py | 4281 | # These tags are model-generated (system prompt tells the model |
| LOW | cli.py | 9481 | if mgr is None or not mgr.is_active(): |
| LOW | cli.py | 11961 | nonlocal result |
| LOW | cli.py | 12041 | # Start agent in background thread (daemon so it cannot keep the |
| LOW | cli.py | 12081 | _f.write(f" child[{_ci}]._interrupt={_ch._interrupt_requested}\n") |
| LOW | cli.py | 12941 | # can safely use prompt_toolkit terminal handoff helpers. |
| LOW | cli.py | 14521 | # to suppress the deliberate "reserve vertical space" scroll-up. |
| LOW | cli.py | 14841 | raise KeyboardInterrupt() # fallback for non-prompt_toolkit contexts |
| LOW | cli.py | 14861 | # reaches this OS-signal path. This matches how Claude Code |
| LOW | cli.py | 15241 | # Also install signal handlers in single-query / `-q` mode. Interactive |
| LOW | cli.py | 15261 | _agent.interrupt(f"received signal {signum}") |
| LOW | cli.py | 15461 | sys.exit(1) |
| LOW | hermes_state.py | 41 | # SQLite's WAL mode requires shared-memory (mmap) coordination and fcntl |
| LOW | hermes_state.py | 401 | self._init_schema() |
| LOW | hermes_state.py | 841 | # is shared across all instances. Two AIAgents that share the same |
| LOW | hermes_state.py | 1441 | # Compute effective_last_active by walking each surfaced session's |
| LOW | hermes_state.py | 2261 | # Step 2: Strip remaining (unmatched) FTS5-special characters |
| LOW | hermes_state.py | 2421 | # CJK queries bypass the unicode61 FTS5 table. The default tokenizer |
| LOW | hermes_state.py | 3441 | " + VACUUM" if result["vacuumed"] else "", |
| LOW | docker-compose.yml | 1 | # |
| LOW | docker-compose.yml | 41 | # To expose the OpenAI-compatible API server beyond localhost, |
| LOW | model_tools.py | 181 | |
| LOW | model_tools.py | 241 | # ============================================================================= |
| LOW | model_tools.py | 481 | # Sanitize schemas for broad backend compatibility. llama.cpp's |
| LOW | model_tools.py | 561 | # Tool error sanitization |
| LOW | model_tools.py | 641 | # Wrap bare non-list values when the schema declares ``array``. |
| LOW | model_tools.py | 841 | # ── Tool Search bridge dispatch ────────────────────────────────── |
| LOW | ui-tui/packages/hermes-ink/src/ink/output.ts | 281 | |
| LOW | ui-tui/packages/hermes-ink/src/ink/dom.ts | 41 | hasRenderedContent?: boolean |
| LOW | ui-tui/packages/hermes-ink/src/ink/dom.ts | 61 | pendingScrollDelta?: number |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 641 | const boxBackgroundColor = node.style.backgroundColor ?? inheritedBackgroundColor |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 761 | // previous max, pin to the new max. Scroll away → stop following; |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 821 | // wheel-accel curve relies on. |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 921 | } |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 1021 | |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 1041 | const spaces = ' '.repeat(w) |
| LOW | …i/packages/hermes-ink/src/ink/render-node-to-output.ts | 1321 | // child's own blit check already fails (node.dirty=true at line 216), so |
| LOW | ui-tui/packages/hermes-ink/src/ink/ink.tsx | 221 | private altScreenParkPatch: Readonly<{ |
| LOW | ui-tui/packages/hermes-ink/src/ink/ink.tsx | 241 | currentIdx: number |
| LOW | ui-tui/packages/hermes-ink/src/ink/ink.tsx | 261 | |
| LOW | ui-tui/packages/hermes-ink/src/ink/ink.tsx | 281 | private prevFrameContaminated = false |
| LOW | ui-tui/packages/hermes-ink/src/ink/ink.tsx | 521 | |
| 578 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | cli.py | 1073 | # Create the worktree |
| MEDIUM | cli.py | 6945 | # Create the new session with parent link |
| MEDIUM | cli.py | 13718 | # Create the input area with multiline (Alt+Enter), autocomplete, and paste handling |
| MEDIUM | cli.py | 14507 | # Create the application |
| MEDIUM | cli.py | 15141 | # Create an isolated worktree so this agent instance doesn't collide |
| MEDIUM | trajectory_compressor.py | 1403 | # Create a temporary directory for processing |
| MEDIUM | trajectory_compressor.py | 1450 | # Create a temp directory with sampled files |
| MEDIUM | tools/skill_manager_tool.py | 504 | # Create the skill directory |
| MEDIUM | tools/discord_tool.py | 442 | # Create a standalone thread |
| MEDIUM | docker/stage2-hook.sh | 24 | # Create the directory (and any missing parents) while we still have root |
| MEDIUM | hermes_cli/backup.py | 201 | # Create the zip |
| MEDIUM | hermes_cli/config.py | 1013 | # Create a guardrail in the Bedrock console, then set the ID and version here. |
| MEDIUM | tests/test_tui_gateway_server.py | 2529 | # Create a minimal PNG file with a space in its name |
| MEDIUM | tests/test_toolsets.py | 65 | # Create a cycle: A includes B, B includes A |
| MEDIUM | tests/test_mcp_serve.py | 186 | # Create a mock SessionDB that reads from our test DB |
| MEDIUM | tests/test_mcp_serve.py | 1094 | # Create a mock SessionDB that reads our test DB |
| MEDIUM | tests/test_hermes_state.py | 1265 | # Create a recent session |
| MEDIUM | tests/test_hermes_state.py | 2503 | # Create a newer standalone session that should sort above the lineage |
| MEDIUM | tests/test_timezone.py | 248 | # Create a job with a NAIVE past timestamp (simulating pre-tz data) |
| MEDIUM | tests/test_timezone.py | 297 | # Create an aware datetime in UTC |
| MEDIUM | tests/test_timezone.py | 273 | # Create a naive datetime — will be interpreted as system-local time |
| MEDIUM | tests/test_hermes_constants.py | 251 | # Create a symlink with fewer path components |
| MEDIUM | tests/honcho_plugin/test_session.py | 873 | # Create a cached session so dialectic_query doesn't bail early |
| MEDIUM | tests/tools/test_transcription_tools.py | 769 | # Create a directory with a valid audio extension |
| MEDIUM | tests/tools/test_modal_bulk_upload.py | 182 | # Create a minimal env without full __init__ |
| MEDIUM | tests/tools/test_docker_find.py | 26 | # Create a fake docker binary at a known path |
| MEDIUM | tests/tools/test_kanban_tools.py | 569 | # Create a real child via the tool so it gets the worker-profile |
| MEDIUM | tests/tools/test_browser_hardening.py | 196 | # Create a snapshot that exceeds 8000 chars |
| MEDIUM | tests/tools/test_browser_homebrew_paths.py | 363 | # Create a mock Popen that captures the env dict |
| MEDIUM | tests/tools/test_send_message_tool.py | 1032 | # Create a test file |
| MEDIUM | tests/tools/test_tirith_security.py | 1018 | # Create a fake executable |
| MEDIUM | tests/tools/test_browser_orphan_reaper.py | 159 | # Create a dir that doesn't match h_* or cdp_* pattern |
| MEDIUM | tests/tools/test_skill_view_traversal.py | 24 | # Create a legitimate file inside the skill |
| MEDIUM | tests/tools/test_skill_view_traversal.py | 29 | # Create a sensitive file outside skills dir (simulating .env) |
| MEDIUM | tests/tools/test_browser_lightpanda.py | 187 | # Create a tiny file simulating the Lightpanda placeholder PNG |
| MEDIUM | tests/tools/test_browser_lightpanda.py | 203 | # Create a larger file simulating a real Chrome screenshot |
| MEDIUM | tests/tools/test_credential_files.py | 144 | # Create a symlink pointing outside the skills tree |
| MEDIUM | tests/tools/test_credential_files.py | 222 | # Create a sensitive file one level above hermes_home |
| MEDIUM | tests/tools/test_credential_files.py | 237 | # Create a fake sensitive file outside hermes_home |
| MEDIUM | tests/tools/test_credential_files.py | 253 | # Create a file at an absolute path |
| MEDIUM | tests/tools/test_credential_files.py | 295 | # Create a sensitive file outside hermes_home |
| MEDIUM | tests/tools/test_credential_files.py | 299 | # Create a symlink inside hermes_home pointing outside |
| MEDIUM | tests/tools/test_docker_environment.py | 1378 | # Create a directory that looks like a corrupted credential file path |
| MEDIUM | tests/tools/test_mcp_stability.py | 185 | # Create a mock HermesCLI-like object with the needed attributes |
| MEDIUM | tests/tools/test_skill_size_limits.py | 90 | # Create a small skill first |
| MEDIUM | tests/tools/test_skill_size_limits.py | 107 | # Create a skill near the limit |
| MEDIUM | tests/tools/test_skill_size_limits.py | 147 | # Create a supporting file |
| MEDIUM | tests/tools/test_vision_tools.py | 544 | # Create a fake image file under a fake home directory |
| MEDIUM | tests/tools/test_vision_tools.py | 755 | # Create a small 10x10 red PNG |
| MEDIUM | tests/tools/test_vision_tools.py | 319 | # Create a real temp file that will be "downloaded" |
| MEDIUM | tests/tools/test_vision_tools.py | 774 | # Create a large image that will exceed 5 MB in base64 |
| MEDIUM | tests/tools/test_vision_tools.py | 878 | # Create a dummy file |
| MEDIUM | tests/tools/test_voice_mode.py | 867 | # Create a file that doesn't match the pattern |
| MEDIUM | tests/tools/test_sync_back_backends.py | 216 | # Create a fake control socket so cleanup tries the SSH exit |
| MEDIUM | tests/tools/test_interrupt.py | 91 | # Create a minimal mock agent with _interrupt_requested = True |
| MEDIUM | tests/docker/test_container_restart.py | 145 | # Create the profile + start its gateway. The Phase 4 hooks |
| MEDIUM | tests/hermes_cli/test_copilot_token_exchange.py | 154 | # Create a minimal pconfig mock |
| MEDIUM | tests/hermes_cli/test_kanban_boards.py | 151 | # Create the board so the env-var value is honoured (get_current_board |
| MEDIUM | tests/hermes_cli/test_kanban_cli.py | 408 | # Create a triage task via the same slash surface. |
| MEDIUM | tests/hermes_cli/test_mcp_config.py | 158 | # Create a fake token file |
| 65 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | hermes_cli/auth.py | 540 | "your_api_key", |
| HIGH | hermes_cli/auth.py | 542 | "your-api-key", |
| HIGH | optional-skills/devops/cli/references/authentication.md | 30 | export INFSH_API_KEY=your-api-key |
| HIGH | optional-skills/mlops/guidance/SKILL.md | 276 | api_key="your-api-key" # Or set ANTHROPIC_API_KEY env var |
| HIGH | optional-skills/mlops/guidance/SKILL.md | 285 | api_key="your-api-key" # Or set OPENAI_API_KEY env var |
| HIGH | optional-skills/mlops/guidance/references/backends.md | 28 | api_key="your-api-key-here" |
| HIGH | optional-skills/mlops/guidance/references/backends.md | 53 | api_key="your-api-key", |
| HIGH | optional-skills/mlops/guidance/references/backends.md | 95 | api_key="your-api-key-here" |
| HIGH | optional-skills/mlops/guidance/references/backends.md | 120 | api_key="your-api-key", |
| HIGH | optional-skills/mlops/pinecone/SKILL.md | 54 | pc = Pinecone(api_key="your-api-key") |
| HIGH | optional-skills/mlops/qdrant/SKILL.md | 422 | api_key="your-api-key" |
| HIGH | …onal-skills/mlops/qdrant/references/troubleshooting.md | 117 | api_key="your-api-key" |
| HIGH | optional-skills/mlops/inference/outlines/SKILL.md | 228 | api_key="your-api-key" |
| HIGH | …skills/mlops/inference/outlines/references/backends.md | 381 | model = outlines.models.openai("gpt-4o-mini", api_key="your-api-key") |
| HIGH | …skills/mlops/inference/outlines/references/backends.md | 393 | api_key="your-api-key", # Or set OPENAI_API_KEY env var |
| HIGH | optional-skills/mlops/instructor/SKILL.md | 345 | Anthropic(api_key="your-api-key") |
| HIGH | optional-skills/mlops/instructor/SKILL.md | 363 | OpenAI(api_key="your-api-key") |
| HIGH | …tional-skills/mlops/instructor/references/providers.md | 16 | Anthropic(api_key="your-api-key") |
| HIGH | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 313 | api_key="your-api-key", # Or set ANTHROPIC_API_KEY env var |
| HIGH | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 325 | api_key="your-api-key", |
| HIGH | …/docs/user-guide/skills/optional/mlops/mlops-qdrant.md | 439 | api_key="your-api-key" |
| HIGH | …s/user-guide/skills/optional/mlops/mlops-instructor.md | 362 | Anthropic(api_key="your-api-key") |
| HIGH | …s/user-guide/skills/optional/mlops/mlops-instructor.md | 380 | OpenAI(api_key="your-api-key") |
| HIGH | …ocs/user-guide/skills/optional/mlops/mlops-pinecone.md | 71 | pc = Pinecone(api_key="your-api-key") |
| HIGH | …ocs/user-guide/skills/optional/mlops/mlops-guidance.md | 293 | api_key="your-api-key" # Or set ANTHROPIC_API_KEY env var |
| HIGH | …ocs/user-guide/skills/optional/mlops/mlops-guidance.md | 302 | api_key="your-api-key" # Or set OPENAI_API_KEY env var |
| HIGH | …uide/skills/optional/mlops/mlops-inference-outlines.md | 245 | api_key="your-api-key" |
| HIGH | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 313 | api_key="your-api-key", # 或设置 ANTHROPIC_API_KEY 环境变量 |
| HIGH | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 325 | api_key="your-api-key", |
| HIGH | …rrent/user-guide/skills/optional/mlops/mlops-qdrant.md | 439 | api_key="your-api-key" |
| HIGH | …t/user-guide/skills/optional/mlops/mlops-instructor.md | 362 | Anthropic(api_key="your-api-key") |
| HIGH | …t/user-guide/skills/optional/mlops/mlops-instructor.md | 380 | OpenAI(api_key="your-api-key") |
| HIGH | …ent/user-guide/skills/optional/mlops/mlops-pinecone.md | 71 | pc = Pinecone(api_key="your-api-key") |
| HIGH | …ent/user-guide/skills/optional/mlops/mlops-guidance.md | 293 | api_key="your-api-key" # 或设置 ANTHROPIC_API_KEY 环境变量 |
| HIGH | …ent/user-guide/skills/optional/mlops/mlops-guidance.md | 302 | api_key="your-api-key" # 或设置 OPENAI_API_KEY 环境变量 |
| HIGH | …uide/skills/optional/mlops/mlops-inference-outlines.md | 245 | api_key="your-api-key" |
| HIGH | tests/gateway/test_weak_credential_guard.py | 59 | config = _make_gateway_config(Platform.SLACK, "your_api_key") |
| HIGH | skills/mlops/research/dspy/SKILL.md | 296 | api_key="your-api-key", # Or set ANTHROPIC_API_KEY env var |
| HIGH | skills/mlops/research/dspy/SKILL.md | 308 | api_key="your-api-key", |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | batch_runner.py | 171 | # Check if error field exists AND has a non-null value |
| LOW | hermes_constants.py | 133 | # Check if this is a profile path: <root>/profiles/<name> |
| LOW | setup-hermes.sh | 288 | # Check if sudo is available |
| LOW | run_agent.py | 1229 | # Check if there's any non-whitespace content remaining |
| LOW | cli.py | 4292 | # Check if we're entering a reasoning block. |
| LOW | cli.py | 4312 | # Check if this is a block boundary position |
| LOW | cli.py | 8963 | # Display result in the CLI (thread-safe via patch_stdout). |
| LOW | cli.py | 9134 | # Check if a Chromium-family browser is already serving CDP on the debug port |
| LOW | cli.py | 12108 | # Check if user fired ANOTHER interrupt (Ctrl+C sets |
| LOW | trajectory_compressor.py | 739 | # Check if compression needed |
| LOW | trajectory_compressor.py | 750 | # Check if there's anything to compress |
| LOW | trajectory_compressor.py | 775 | # Check if we have enough savings |
| LOW | trajectory_compressor.py | 846 | # Check if compression needed |
| LOW | trajectory_compressor.py | 857 | # Check if there's anything to compress |
| LOW | mcp_serve.py | 352 | # Check if sessions.json has changed (mtime check is ~1μs) |
| LOW | mcp_serve.py | 363 | # Check if state.db has changed |
| LOW | tools/vision_tools.py | 980 | # Check if vision model is available |
| LOW | tools/process_registry.py | 786 | # Check if process is still running |
| LOW | tools/process_registry.py | 1422 | # Check if PID is still alive |
| LOW | tools/web_tools.py | 374 | # Check if we need chunked processing |
| LOW | tools/web_tools.py | 1180 | # Check if API keys are available |
| LOW | tools/skills_hub.py | 681 | # Check if ANY entry lives under the target path |
| LOW | tools/fuzzy_match.py | 691 | # Check if this block matches |
| LOW | tools/mixture_of_agents_tool.py | 337 | # Check if we have enough successful responses to proceed |
| LOW | tools/mixture_of_agents_tool.py | 448 | # Check if API key is available |
| LOW | tools/browser_tool.py | 1379 | # Check if the daemon is still alive. ``os.kill(pid, 0)`` on Windows |
| LOW | tools/browser_tool.py | 1679 | # Check if we already have a session for this task |
| LOW | tools/browser_tool.py | 1779 | # Check if it's in PATH (global install) |
| LOW | tools/browser_tool.py | 2523 | # Check if snapshot needs summarization |
| LOW | tools/browser_tool.py | 3174 | # Check if screenshot file was created |
| LOW | tools/browser_tool.py | 3429 | # Check if session exists (under lock), but don't remove yet - |
| LOW | tools/terminal_tool.py | 1928 | # Check if this is an approval_required (gateway ask mode) |
| LOW | tools/skills_tool.py | 1007 | # Read the file once — reused for platform check and main content below |
| LOW | tools/skills_tool.py | 1064 | # Check if the skill is disabled by the user |
| LOW | tools/skills_tool.py | 1152 | # Read the file content |
| LOW | tools/skills_guard.py | 933 | # Check if source matches any trusted repo exactly, or a skill path inside |
| LOW | tools/mcp_tool.py | 1750 | # Check if shutdown was requested during the sleep |
| LOW | tools/mcp_tool.py | 2514 | # Check if the MCP tool itself returned an error |
| LOW | tools/file_operations.py | 1618 | # Check if parent directory exists and list similar entries |
| LOW | tools/file_operations.py | 783 | # Check if file exists and get size (wc -c is POSIX, works on Linux + macOS) |
| LOW | tools/file_operations.py | 797 | # Check if file is too large |
| LOW | tools/file_operations.py | 844 | # Check if truncated |
| LOW | hermes_cli/backup.py | 305 | # Check if all entries share a common first directory |
| LOW | hermes_cli/gateway.py | 4656 | # Check if signal-cli is available |
| LOW | hermes_cli/config.py | 1265 | # Set this to True to re-enable the surfaces with the understanding |
| LOW | hermes_cli/config.py | 2097 | # Set 0 to disable. |
| LOW | hermes_cli/config.py | 3694 | # Check if dict keys look like they should be list-entry fields |
| LOW | hermes_cli/config.py | 5565 | # Check if it's an API key (goes to .env) |
| LOW | hermes_cli/models.py | 1386 | # Check if this provider has credentials available |
| LOW | hermes_cli/skills_hub.py | 482 | # Check if any source hit GitHub API rate limit |
| LOW | hermes_cli/skills_hub.py | 561 | # Check if already installed |
| LOW | hermes_cli/model_switch.py | 951 | # Check if the requested model matches the entry's model |
| LOW | hermes_cli/model_switch.py | 1223 | # Check if any env var is set |
| LOW | hermes_cli/model_switch.py | 1283 | # Check if credentials exist |
| LOW | hermes_cli/web_server.py | 4464 | # Check if this plugin provides tools that require auth |
| LOW | hermes_cli/setup.py | 1108 | # Check if already installed |
| LOW | hermes_cli/setup.py | 1254 | # Check if already installed |
| LOW | hermes_cli/setup.py | 1371 | # Check if Docker is available |
| LOW | hermes_cli/setup.py | 1390 | # Check if singularity/apptainer is available |
| LOW | hermes_cli/setup.py | 1450 | # Check if modal SDK is installed |
| 82 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | hermes_state.py | 2251 | # Step 1: Extract balanced double-quoted phrases and protect them |
| LOW | hermes_state.py | 2261 | # Step 2: Strip remaining (unmatched) FTS5-special characters |
| LOW | hermes_state.py | 2264 | # Step 3: Collapse repeated * (e.g. "***") into a single one, |
| LOW | hermes_state.py | 2269 | # Step 4: Remove dangling boolean operators at start/end that would |
| LOW | hermes_state.py | 2274 | # Step 5: Wrap unquoted dotted and/or hyphenated terms in double |
| LOW | hermes_state.py | 2282 | # Step 6: Restore preserved quoted phrases |
| LOW | tools/skills_hub.py | 1417 | # Step 1: fetch the sitemap index → list of skill-sitemap URLs. |
| LOW | tools/skills_hub.py | 1439 | # Step 2: fetch each skill sitemap and collect canonical "owner/repo/skill" IDs. |
| LOW | tools/skills_sync.py | 609 | # Step 1: drop the manifest entry so next sync treats it as new |
| LOW | tools/skills_sync.py | 644 | # Step 3: run sync to re-baseline (or re-copy if we deleted) |
| LOW | tools/mcp_oauth_manager.py | 212 | # Step 1: PRM discovery to learn the authorization_server URL. |
| LOW | tools/mcp_oauth_manager.py | 234 | # Step 2: ASM discovery against the auth_server_url (or |
| LOW | tools/mcp_oauth_manager.py | 539 | # Step 1: Did disk change? Picks up external refresh. |
| LOW | tools/mcp_oauth_manager.py | 548 | # Step 2: No disk change — if the SDK can refresh |
| LOW | tools/yuanbao_tools.py | 372 | # Step 2: Send text DM + media |
| LOW | tools/yuanbao_tools.py | 382 | # Step 3: Send media files |
| LOW | tools/yuanbao_tools.py | 324 | # Step 1: Resolve user_id from group member list if not provided |
| LOW | tools/send_message_tool.py | 1694 | # Step 1: Get access token |
| LOW | tools/send_message_tool.py | 1706 | # Step 2: Send message via REST |
| LOW | tools/computer_use/cua_backend.py | 359 | # Step 1: enumerate on-screen windows to find target pid/window_id. |
| LOW | tools/computer_use/cua_backend.py | 421 | # Step 2: capture. |
| LOW | hermes_cli/auth.py | 6736 | # Step 1: Request device code |
| LOW | hermes_cli/auth.py | 6767 | # Step 2: Show user the code |
| LOW | hermes_cli/auth.py | 6775 | # Step 3: Poll for authorization code |
| LOW | hermes_cli/auth.py | 6810 | # Step 4: Exchange authorization code for tokens |
| LOW | hermes_cli/skills_config.py | 136 | # Step 1: Select platform |
| LOW | hermes_cli/skills_config.py | 140 | # Step 2: Select mode — individual or by category |
| LOW | hermes_cli/dingtalk_auth.py | 66 | # Step 1: init → nonce |
| LOW | hermes_cli/dingtalk_auth.py | 72 | # Step 2: begin → device_code, verification_uri_complete |
| LOW | hermes_cli/send_cmd.py | 217 | # Step 1: dotenv |
| LOW | hermes_cli/send_cmd.py | 241 | # Step 2: bridge top-level config.yaml values into the environment so |
| LOW | hermes_cli/web_server.py | 2233 | # Step 1: request device code |
| LOW | hermes_cli/web_server.py | 2260 | # Step 2: poll until authorized |
| LOW | hermes_cli/web_server.py | 2284 | # Step 3: exchange authorization_code for tokens |
| LOW | hermes_cli/setup.py | 3258 | # Step 1: Model & Provider (essential — skips rotation/vision/TTS) |
| LOW | hermes_cli/setup.py | 3261 | # Step 2: Terminal Backend — where commands run is a core decision |
| LOW | hermes_cli/setup.py | 3264 | # Step 3: Apply defaults for everything else |
| LOW | hermes_cli/setup.py | 3269 | # Step 4: Offer messaging gateway setup |
| LOW | hermes_cli/tools_config.py | 795 | # Step 2: only the local browser provider actually needs Chromium on |
| LOW | hermes_cli/tools_config.py | 801 | # Step 3: ensure the Chromium / headless-shell build agent-browser |
| LOW | hermes_cli/tools_config.py | 772 | # Step 1: install the agent-browser npm package into node_modules/ |
| LOW | hermes_cli/copilot_auth.py | 174 | # Step 1: Request device code |
| LOW | hermes_cli/copilot_auth.py | 207 | # Step 2: Show instructions |
| LOW | hermes_cli/copilot_auth.py | 214 | # Step 3: Poll for completion |
| LOW | hermes_cli/main.py | 2370 | # Step 1: Provider selection — flat list from CANONICAL_PROVIDERS |
| LOW | hermes_cli/main.py | 2414 | # Step 2: Provider-specific setup + model selection |
| LOW | hermes_cli/main.py | 5121 | # Step 1: Check / prompt for API key |
| LOW | hermes_cli/main.py | 5134 | # Step 2: Auto-detect endpoint from key prefix |
| LOW | hermes_cli/main.py | 5147 | # Step 3: Model selection — show appropriate models for the endpoint |
| LOW | plugins/memory/hindsight/__init__.py | 657 | # Step 1: Mode selection |
| LOW | plugins/memory/hindsight/__init__.py | 673 | # Step 2: Install/upgrade deps for selected mode |
| LOW | plugins/memory/hindsight/__init__.py | 700 | # Step 3: Mode-specific config |
| LOW | plugins/memory/hindsight/__init__.py | 775 | # Step 4: Save everything |
| LOW | optional-skills/finance/stocks/scripts/stocks_client.py | 156 | # Step 1: touch Yahoo Finance to get cookies |
| LOW | optional-skills/finance/stocks/scripts/stocks_client.py | 164 | # Step 2: fetch crumb |
| LOW | …tional-skills/productivity/here-now/scripts/publish.sh | 307 | # Step 1: Create/update publish |
| LOW | …tional-skills/productivity/here-now/scripts/publish.sh | 331 | # Step 2: Upload files (skipped files are unchanged from previous version) |
| LOW | …tional-skills/productivity/here-now/scripts/publish.sh | 371 | # Step 3: Finalize |
| LOW | tests/test_model_tools.py | 252 | # Step 1: caller checks for a block directive (this fires pre_tool_call once). |
| LOW | tests/test_model_tools.py | 258 | # Step 2: caller dispatches with skip=True so the hook isn't re-fired. |
| 39 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | cli.py | 2078 | # • None (some mocks / older PT builds) — just call the inner |
| MEDIUM | trajectory_compressor.py | 1182 | """Print comprehensive compression summary statistics.""" |
| MEDIUM | tools/web_tools.py | 465 | system_prompt = """You are an expert content analyst. Your job is to process web content and create a comprehens |
| MEDIUM | tools/web_tools.py | 474 | user_prompt = f"""Please process this web content and create a comprehensive markdown summary: |
| LOW | tools/web_tools.py | 611 | # If only one chunk succeeded, just return it (with cap) |
| MEDIUM | tools/mixture_of_agents_tool.py | 83 | AGGREGATOR_SYSTEM_PROMPT = """You have been provided with a set of responses from various open-source models to the late |
| MEDIUM | tools/browser_supervisor.py | 1057 | # Parse query string for dialog metadata. Use urllib to be robust. |
| LOW | tools/kanban_tools.py | 569 | # the write txn), so the worker can simply call |
| MEDIUM | docker/hermes-exec-shim.sh | 69 | # Reference it by absolute path so the drop is robust against PATH |
| MEDIUM | hermes_cli/gateway.py | 3343 | # Absolutely everything else: Exception, asyncio.CancelledError, |
| LOW | hermes_cli/models.py | 1632 | # Already on openrouter, just return the resolved slug |
| LOW | hermes_cli/web_server.py | 1235 | pass # can't read disk config — just use the string form |
| LOW | hermes_cli/kanban.py | 1245 | # dispatcher doesn't need to enumerate — we just pass the name |
| MEDIUM | plugins/kanban/dashboard/plugin_api.py | 1911 | # the simplest and most robust approach; it adds a fraction of a percent |
| MEDIUM | web/package-lock.json | 8239 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", |
| MEDIUM | website/package-lock.json | 17646 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz", |
| LOW | tests/tools/test_env_probe.py | 154 | # Should not raise, should just return "" |
| MEDIUM | tests/docker/test_gateway_run_supervised.py | 92 | # harness profile has a configured model, but the want-intent |
| LOW | tests/hermes_cli/test_codex_runtime_plugin_migration.py | 842 | # We can't easily create one in the test, so just use a stable path |
| LOW | tests/hermes_cli/test_commands.py | 1802 | # Both calls should succeed and just return the built-in set. |
| LOW | tests/hermes_cli/test_voice_wrapper.py | 289 | # Should simply return None without raising. |
| LOW | tests/plugins/test_langfuse_plugin.py | 166 | # Each hook should just return; no exceptions. |
| MEDIUM | tests/plugins/transcription/check_parity_vs_main.py | 192 | # so the harness can distinguish command-provider dispatch from a |
| MEDIUM | tests/plugins/tts/check_parity_vs_main.py | 198 | # This is the ONLY acceptable diff in the harness. |
| MEDIUM | tests/agent/test_codex_ttfb_watchdog.py | 49 | # the test is robust to detection-logic changes elsewhere. |
| LOW | tests/agent/test_context_engine.py | 40 | # Trivial: just return as-is |
| MEDIUM | tests/acp/test_ping_suppression.py | 166 | # Test harness reads agent output via this StreamReader: |
| MEDIUM | tests/gateway/conftest.py | 43 | """Install a comprehensive telegram mock in sys.modules. |
| MEDIUM | tests/gateway/conftest.py | 87 | """Install a comprehensive discord mock in sys.modules. |
| MEDIUM | tests/gateway/test_api_server.py | 1163 | # the test robust against preview-formatter tweaks. |
| LOW | tests/gateway/test_session_env.py | 29 | # Can't use var.reset() without a token; just set back to sentinel. |
| LOW | tests/gateway/test_session_env.py | 215 | # After clearing, the session key must not retain the value we just set. |
| LOW | tests/gateway/test_slash_access_dispatch.py | 414 | # If /history has aliases, use one. Otherwise just use /history. |
| LOW | tests/gateway/test_pairing.py | 272 | # Approving with any code must just return None, not crash. |
| MEDIUM | agent/error_classifier.py | 479 | # Build a comprehensive error message string for pattern matching. |
| MEDIUM | agent/background_review.py | 389 | # run_conversation() then leaks the harness prompt |
| MEDIUM | agent/background_review.py | 393 | # sync_all (harness prompt + review output recorded |
| MEDIUM | tui_gateway/server.py | 3893 | # Save-first: mirrors CLI keybinding path; more robust than has_image() precheck |
| MEDIUM | .github/workflows/docker-publish.yml | 126 | # real-API calls from inside the harness. |
| MEDIUM | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| MEDIUM | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| MEDIUM | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| MEDIUM | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| MEDIUM | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| LOW | gateway/run.py | 9635 | # No existing session, just create one |
| MEDIUM | gateway/platforms/telegram.py | 5306 | # Normalize mime_type for robust comparisons (some clients send |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | toolset_distributions.py | 248 | Sample toolsets based on a distribution's probabilities. Each toolset in the distribution has a % chance o |
| HIGH | tools/vision_tools.py | 131 | Download an image from a URL to a local destination (async) with retry logic. Args: image_url (str |
| HIGH | tools/vision_tools.py | 668 | Analyze an image from a URL or local file path using vision AI. This tool accepts either an HTTP/HTTPS URL |
| HIGH | tools/web_tools.py | 765 | Search the web for information using available search API backend. This function provides a generic interface |
| HIGH | tools/web_tools.py | 878 | Extract content from specific web pages using available extraction API backend. This function provides a gener |
| HIGH | tools/mixture_of_agents_tool.py | 241 | Process a complex query using the Mixture-of-Agents methodology. This tool leverages multiple frontier lan |
| HIGH | tools/terminal_tool.py | 1732 | Execute a command in the configured terminal environment. Args: command: The command to execute |
| HIGH | hermes_cli/model_normalize.py | 247 | Detect the vendor slug from a bare model name. Uses the first hyphen-delimited token of the model name to look up |
| HIGH | hermes_cli/model_normalize.py | 327 | Translate a model name into the format the target provider's API expects. This is the primary entry point for model |
| HIGH | agent/auxiliary_client.py | 4825 | Centralized synchronous LLM call. Resolves provider + model (from task config, explicit args, or auto-detect), |
| HIGH | gateway/platforms/base.py | 587 | Save raw image bytes to the cache and return the absolute file path. Args: data: Raw image bytes. |
| HIGH | gateway/platforms/base.py | 615 | Download an image from a URL and save it to the local cache. Retries on transient failures (timeouts, 429, 5xx |
| HIGH | gateway/platforms/base.py | 729 | Download an audio file from a URL and save it to the local cache. Retries on transient failures (timeouts, 429 |
| HIGH | gateway/platforms/base.py | 1210 | Save raw document bytes to the cache and return the absolute file path. The cached filename preserves the orig |
| HIGH | gateway/platforms/yuanbao_media.py | 206 | 下载 URL 内容,返回 (bytes, content_type)。 Args: url: HTTP(S) URL max_size_mb: 最大允许大小(MB),超 |
| HIGH | gateway/platforms/yuanbao_media.py | 348 | 调用 genUploadInfo 接口获取 COS 临时密钥及上传配置。 Args: app_key: 应用 Key(用于 X-ID 头) api_domain: A |
| HIGH | gateway/platforms/yuanbao_media.py | 425 | 通过 httpx PUT 请求将文件上传到 COS。 使用临时凭证(tmpSecretId/tmpSecretKey/sessionToken)构建 HMAC-SHA1 签名。 Args: fil |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | plugins/memory/holographic/store.py | 402 | 1. Capitalized multi-word phrases e.g. "John Doe" |
| LOW | optional-skills/mlops/inference/outlines/SKILL.md | 78 | print(user.name) # "John Doe" |
| LOW | optional-skills/mlops/instructor/SKILL.md | 70 | print(user.name) # "John Doe" |
| LOW | optional-skills/mlops/instructor/SKILL.md | 636 | "name": "John Doe", |
| LOW | optional-skills/mlops/instructor/SKILL.md | 678 | "name": "John Doe", |
| LOW | optional-skills/productivity/here-now/SKILL.md | 140 | -d '{"email": "user@example.com"}' |
| LOW | optional-skills/productivity/here-now/SKILL.md | 149 | -d '{"email":"user@example.com","code":"ABCD-2345"}' |
| LOW | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 375 | print(result.person.name) # "John Doe" |
| LOW | …/user-guide/skills/bundled/creative/creative-sketch.md | 103 | - Realistic fake content — actual sentences, actual names, not "Lorem ipsum" |
| LOW | …user-guide/skills/bundled/creative/creative-pretext.md | 67 | - **Real source/text, not lorem ipsum.** The corpus should mean something. Short manifestos, poetry, real source code, a |
| LOW | …user-guide/skills/bundled/creative/creative-pretext.md | 217 | - [ ] Corpus is real prose, not lorem ipsum, and matches the demo's concept |
| LOW | …ide/skills/bundled/productivity/productivity-notion.md | 332 | - **Email:** `{"email": "user@example.com"}` |
| LOW | …e/skills/bundled/productivity/productivity-nano-pdf.md | 61 | nano-pdf edit contract.pdf 2 "Change the client name from 'Acme Corp' to 'Acme Industries'" |
| LOW | …e/skills/bundled/productivity/productivity-airtable.md | 122 | - Exact match: `{Email}='user@example.com'` |
| LOW | …e/skills/bundled/productivity/productivity-airtable.md | 184 | {"fields": {"Email": "user@example.com", "Status": "Active"}} |
| LOW | …s/user-guide/skills/optional/mlops/mlops-instructor.md | 87 | print(user.name) # "John Doe" |
| LOW | …s/user-guide/skills/optional/mlops/mlops-instructor.md | 653 | "name": "John Doe", |
| LOW | …s/user-guide/skills/optional/mlops/mlops-instructor.md | 695 | "name": "John Doe", |
| LOW | …uide/skills/optional/mlops/mlops-inference-outlines.md | 95 | print(user.name) # "John Doe" |
| LOW | …/skills/optional/productivity/productivity-here-now.md | 154 | -d '{"email": "user@example.com"}' |
| LOW | …/skills/optional/productivity/productivity-here-now.md | 163 | -d '{"email":"user@example.com","code":"ABCD-2345"}' |
| LOW | …user-guide/skills/bundled/mlops/mlops-research-dspy.md | 375 | print(result.person.name) # "John Doe" |
| LOW | …/user-guide/skills/bundled/creative/creative-sketch.md | 103 | - 真实的虚假内容——实际句子、实际姓名,而非"Lorem ipsum" |
| LOW | …user-guide/skills/bundled/creative/creative-pretext.md | 67 | - **使用真实语料,而非 lorem ipsum。** 语料库应有意义。短篇宣言、诗歌、真实源代码、发现的文本、库自身的 README —— 绝不用 `lorem ipsum`。 |
| LOW | …user-guide/skills/bundled/creative/creative-pretext.md | 217 | - [ ] 语料库为真实散文,非 lorem ipsum,且与演示概念匹配 |
| LOW | …ide/skills/bundled/productivity/productivity-notion.md | 332 | - **邮箱(Email):** `{"email": "user@example.com"}` |
| LOW | …e/skills/bundled/productivity/productivity-nano-pdf.md | 61 | nano-pdf edit contract.pdf 2 "Change the client name from 'Acme Corp' to 'Acme Industries'" |
| LOW | …e/skills/bundled/productivity/productivity-airtable.md | 122 | - 精确匹配:`{Email}='user@example.com'` |
| LOW | …e/skills/bundled/productivity/productivity-airtable.md | 184 | {"fields": {"Email": "user@example.com", "Status": "Active"}} |
| LOW | …t/user-guide/skills/optional/mlops/mlops-instructor.md | 87 | print(user.name) # "John Doe" |
| LOW | …t/user-guide/skills/optional/mlops/mlops-instructor.md | 653 | "name": "John Doe", |
| LOW | …t/user-guide/skills/optional/mlops/mlops-instructor.md | 695 | "name": "John Doe", |
| LOW | …uide/skills/optional/mlops/mlops-inference-outlines.md | 95 | print(user.name) # "John Doe" |
| LOW | …/skills/optional/productivity/productivity-here-now.md | 154 | -d '{"email": "user@example.com"}' |
| LOW | …/skills/optional/productivity/productivity-here-now.md | 163 | -d '{"email":"user@example.com","code":"ABCD-2345"}' |
| LOW | tests/hermes_cli/test_doctor.py | 932 | {"logged_in": True, "email": "user@example.com"}, |
| LOW | tests/agent/test_file_safety_credentials.py | 176 | "email": "user@example.com", |
| LOW | tests/agent/test_gemini_cloudcode.py | 204 | email="user@example.com", |
| LOW | tests/cli/test_worktree_security.py | 15 | subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=repo, check=True, capture_output=True) |
| LOW | tests/cli/test_worktree.py | 21 | ["git", "config", "user.email", "test@test.com"], |
| LOW | tests/cli/test_worktree.py | 55 | ["git", "config", "user.email", "test@test.com"], |
| LOW | tests/cli/test_worktree.py | 78 | ["git", "config", "user.email", "test@test.com"], |
| LOW | tests/gateway/test_email.py | 876 | raw_email["From"] = '"John Doe" <john@test.com>' |
| LOW | tests/gateway/test_email.py | 410 | "sender_name": "John Doe", |
| LOW | tests/gateway/test_email.py | 423 | self.assertEqual(event.source.user_name, "John Doe") |
| LOW | tests/gateway/test_email.py | 896 | self.assertEqual(results[0]["sender_name"], "John Doe") |
| LOW | tests/gateway/test_bluebubbles.py | 42 | monkeypatch.setenv("BLUEBUBBLES_HOME_CHANNEL", "user@example.com") |
| LOW | tests/gateway/test_bluebubbles.py | 49 | assert hc.chat_id == "user@example.com" |
| LOW | tests/gateway/test_bluebubbles.py | 95 | result = await adapter.send("user@example.com", "first thought\n\nsecond thought") |
| LOW | tests/gateway/test_bluebubbles.py | 140 | "chatIdentifier": "user@example.com", |
| LOW | tests/gateway/test_bluebubbles.py | 257 | "chatIdentifier": "user@example.com", |
| LOW | tests/gateway/test_bluebubbles.py | 158 | "handle": {"address": "user@example.com"}, |
| LOW | tests/gateway/test_bluebubbles.py | 190 | assert chat_identifier == "user@example.com" |
| LOW | tests/gateway/test_send_multiple_images.py | 432 | _run(adapter.send_multiple_images("user@example.com", images)) |
| LOW | tests/gateway/test_send_multiple_images.py | 436 | assert to_addr == "user@example.com" |
| LOW | tests/gateway/test_send_multiple_images.py | 449 | _run(adapter.send_multiple_images("user@example.com", images)) |
| LOW | tests/gateway/test_send_multiple_images.py | 461 | _run(adapter.send_multiple_images("user@example.com", [])) |
| LOW | agent/google_oauth.py | 19 | "email": "user@example.com" |
| LOW | skills/mlops/research/dspy/SKILL.md | 358 | print(result.person.name) # "John Doe" |
| LOW | skills/mlops/research/dspy/references/modules.md | 236 | print(result.person.name) # "John Doe" |
| 14 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| CRITICAL | …tional-skills/mlops/training/axolotl/references/api.md | 658 | core.trainers.grpo.sampler.SequenceParallelRepeatRandomSampler.set_epoch(epoch) |
| CRITICAL | …tional-skills/mlops/training/axolotl/references/api.md | 1795 | core.trainers.grpo.trainer.AxolotlGRPOSequenceParallelTrainer.get_train_dataloader( |
| CRITICAL | …tional-skills/mlops/training/axolotl/references/api.md | 4690 | core.trainers.dpo.trainer.AxolotlDPOTrainer.push_to_hub(*args, **kwargs) |
| CRITICAL | …tional-skills/mlops/training/axolotl/references/api.md | 4892 | core.trainers.mixins.scheduler.SchedulerMixin.create_scheduler( |
| CRITICAL | tests/gateway/test_stream_consumer_thread_routing.py | 176 | mock_client.im.v1.message.create.assert_called_once() |
| CRITICAL | tests/gateway/test_stream_consumer_thread_routing.py | 227 | mock_client.im.v1.message.create.assert_called_once() |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | …ve/kanban-video-orchestrator/references/tool-matrix.md | 177 | # - comfyui (AI-generated visuals) |
| HIGH | …er-guide/skills/bundled/creative/creative-humanizer.md | 590 | This skill is ported from [blader/humanizer](https://github.com/blader/humanizer) (MIT licensed), which is itself based |
| HIGH | skills/index-cache/lobehub_index.json | 1 | {"schemaVersion": 1, "agents": [{"author": "CSY2022", "createdAt": "2025-06-19", "homepage": "https://github.com/CSY2022 |
| HIGH | …ls/creative/popular-web-designs/templates/replicate.md | 266 | - "Create a manifesto section on Replicate Dark (#202020) with 'Imagine what you can build.' at 128px rb-freigeist-neue |
| HIGH | skills/creative/humanizer/SKILL.md | 574 | This skill is ported from [blader/humanizer](https://github.com/blader/humanizer) (MIT licensed), which is itself based |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | docker-compose.windows.yml | 9 | # Usage: |
| LOW | setup-hermes.sh | 8 | # Usage: |
| LOW | docker-compose.yml | 4 | # Usage: |
| LOW | tools/registry.py | 554 | # Usage: |
| LOW | scripts/kill_modal.sh | 4 | # Usage: |
| LOW | scripts/install.sh | 8 | # Usage: |
| LOW | scripts/setup_open_webui.sh | 12 | # Usage: |
| LOW | scripts/run_tests.sh | 16 | # Usage: |
| LOW | scripts/lib/node-bootstrap.sh | 15 | # Usage: |
| LOW | skills/creative/comfyui/scripts/comfyui_setup.sh | 14 | # Usage: |
| LOW | skills/creative/p5js/scripts/render.sh | 5 | # Usage: |
| LOW | skills/creative/p5js/scripts/serve.sh | 5 | # Usage: |
| LOW | datagen-config-examples/web_research.yaml | 6 | # Usage: |
| LOW | datagen-config-examples/run_browser_tasks.sh | 17 | # Usage: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | tests/gateway/test_discord_free_response.py | 68 | |
| MEDIUM | tests/gateway/test_discord_free_response.py | 93 | |
| MEDIUM | tests/gateway/test_discord_slash_commands.py | 630 | |
| MEDIUM | tests/gateway/test_discord_slash_commands.py | 649 |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | tools/web_tools.py | 450 | 5. Note any references to other sections (e.g., "as mentioned earlier", "see below") without trying to resolve them |
| MEDIUM | datagen-config-examples/run_browser_tasks.sh | 57 | # Common options you can add: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | mini_swe_runner.py | 414 | def run_task(self, task: str) -> Dict[str, Any]: |
| LOW | tests/tools/test_patch_parser.py | 199 | +def helper(): |
| LOW | tests/tools/test_patch_parser.py | 226 | assert "def helper():" in file_ops.written |
| LOW | tests/hermes_cli/test_xai_oauth_pkce_token_exchange.py | 326 | def handle_request(self, request): |
| LOW | tui_gateway/server.py | 465 | def handle_request(req: dict) -> dict | None: |