hermes-agent

ouyangbo/hermes-agent

Fork 0

Commit Graph

Author	SHA1	Message	Date
Teknium	2b48ba0249	fix: clean up SkillEvaluator Tier 1 security findings in bundled skills Findings from scanning skills/ + optional-skills/ with NVIDIA SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode smuggling, script lint): - pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal paths (use ~ / portable phrasing); pokemon-player no longer claims machine-specific state as fact - kanban-video-orchestrator: replace <path> angle-bracket token in frontmatter credits (flagged as XML-in-frontmatter prompt injection) - comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase placeholder secrets so they no longer pattern-match real credentials (your-* placeholder convention, comment markers, {env:...} form) - docker-management, pytorch-lightning: drop user:pass@ from example connection strings (env/secret-manager guidance instead) - evm: break up Keccak round constant that Luhn-validates as a credit card number (digit-group underscores, value unchanged) All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which retains scanner false positives only (Colab notebook IDs read as Bitcoin addresses; an email inside a quoted upstream system prompt).	2026-08-08 10:45:21 -07:00
teknium1	1c646499b6	fix(skills): sync mlops training/model-infra skills to current APIs Seven optional mlops training skills had stale APIs, config paths, image locations, and requirement pins. Verified against upstream and corrected: - torchtitan: removed TOML train_configs paths (replaced upstream by config registry) - trl-fine-tuning: PPO removed from TRL 1.x -> GRPO/RLOO; SFTTrainer tokenizer= -> processing_class - flash-attention: torch.backends.cuda.sdp_kernel (deprecated) -> torch.nn.attention.sdpa_kernel; corrected false FA3/FP8-in-pip claim (FA2 only) - accelerate: DeepSpeedPlugin instance not raw dict; --config_file expects accelerate YAML; auto_wrap_policy -> transformer_based_wrap - saelens: v6 nested training config (sae=/logger=); from_pretrained tuple -> from_pretrained_with_cfg_and_sparsity - tensorrt-llm: Docker Hub image 404 -> NGC nvcr.io; rc pin -> GA; CUDA req updated - nemo-curator: pip extras renamed; repo moved to NVIDIA-NeMo/Curator; 1.x pipeline rewrite noted	2026-07-24 08:18:05 -07:00
Teknium	ded194eb6a	chore(skills): move heavy training skills + outlines to optional-skills (#22912 ) These skills require heavy GPU/CUDA stacks or are niche enough that they shouldn't be active by default. Moved to optional-skills/ where users opt-in via `hermes skills install official/...`. Moved: - mlops/training/axolotl - mlops/training/trl-fine-tuning - mlops/training/unsloth - mlops/inference/outlines Counts: 91 -> 87 built-in, 72 -> 76 optional. Auto-regenerated docs (per-skill pages + catalogs) reflect the move.	2026-05-09 18:44:12 -07:00

Author

SHA1

Message

Date

Teknium

2b48ba0249

fix: clean up SkillEvaluator Tier 1 security findings in bundled skills

Findings from scanning skills/ + optional-skills/ with NVIDIA
SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode
smuggling, script lint):

- pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal
  paths (use ~ / portable phrasing); pokemon-player no longer claims
  machine-specific state as fact
- kanban-video-orchestrator: replace <path> angle-bracket token in
  frontmatter credits (flagged as XML-in-frontmatter prompt injection)
- comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase
  placeholder secrets so they no longer pattern-match real credentials
  (your-* placeholder convention, comment markers, {env:...} form)
- docker-management, pytorch-lightning: drop user:pass@ from example
  connection strings (env/secret-manager guidance instead)
- evm: break up Keccak round constant that Luhn-validates as a credit
  card number (digit-group underscores, value unchanged)

All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which
retains scanner false positives only (Colab notebook IDs read as Bitcoin
addresses; an email inside a quoted upstream system prompt).

2026-08-08 10:45:21 -07:00

teknium1

1c646499b6

fix(skills): sync mlops training/model-infra skills to current APIs

Seven optional mlops training skills had stale APIs, config paths, image locations, and requirement pins. Verified against upstream and corrected:

- torchtitan: removed TOML train_configs paths (replaced upstream by config registry)
- trl-fine-tuning: PPO removed from TRL 1.x -> GRPO/RLOO; SFTTrainer tokenizer= -> processing_class
- flash-attention: torch.backends.cuda.sdp_kernel (deprecated) -> torch.nn.attention.sdpa_kernel; corrected false FA3/FP8-in-pip claim (FA2 only)
- accelerate: DeepSpeedPlugin instance not raw dict; --config_file expects accelerate YAML; auto_wrap_policy -> transformer_based_wrap
- saelens: v6 nested training config (sae=/logger=); from_pretrained tuple -> from_pretrained_with_cfg_and_sparsity
- tensorrt-llm: Docker Hub image 404 -> NGC nvcr.io; rc pin -> GA; CUDA req updated
- nemo-curator: pip extras renamed; repo moved to NVIDIA-NeMo/Curator; 1.x pipeline rewrite noted

2026-07-24 08:18:05 -07:00

Teknium

ded194eb6a

chore(skills): move heavy training skills + outlines to optional-skills (#22912 )

These skills require heavy GPU/CUDA stacks or are niche enough that they shouldn't
be active by default. Moved to optional-skills/ where users opt-in via
`hermes skills install official/...`.

Moved:
- mlops/training/axolotl
- mlops/training/trl-fine-tuning
- mlops/training/unsloth
- mlops/inference/outlines

Counts: 91 -> 87 built-in, 72 -> 76 optional.

Auto-regenerated docs (per-skill pages + catalogs) reflect the move.

2026-05-09 18:44:12 -07:00

3 Commits