What they did
Subramaniam, who works in cybersecurity, already let Hermes run his homelab. Allowlists, deny patterns, Hermes's smart approval policy and a second decision model all judged commands as text, so a call like python3 on a script file passed without anyone reading the file. With Hermes as his pair programmer he wrote command-reviewer, a Hermes plugin that runs before every command: fixed rules that block anything touching credentials or destroying data, a skip list for trivial read-only commands, and a model reviewer that returns safe, suspicious or malicious for the rest, including the contents of any script. They built a test battery together, ran it in shadow mode for a few days and then switched it to enforce.
How it went
Over two days of versions they fixed what broke. The reviewer sometimes returned empty answers, so it now retries once and then asks him. The first three attempts to read scripts read the wrong machine, because commands run in a Docker sandbox and the plugin does not; it now reads the file through the sandbox container. A prompt that never reached his screen let a command run, so anything it cannot review is now blocked. Approvals are stored with a SHA-256 of the file, and a repeat passed in six milliseconds. A decoy script whose comments claimed its outgoing token was harmless was blocked. He has opened a PR to add it to Hermes's plugin catalog.
Worth knowing
The plugin can only add checks; Hermes's built-in approval layer still asks again for flagged patterns like rm -rf, even on harmless or repeated commands. Treat everything inside a script, comments included, as untrusted input to the reviewer, and fail closed when it cannot read or judge something.