---

name: hermes-injection-av description: "Hermes prompt-injection antivirus. Use when the user mentions injection defense, AV for Hermes, prompt-injection scanning, hermes_inj_av daemon, sanitizer/quarantine/memory_gate/tool_gate, canary leaks, or wants to install, start, stop, status-check, scan, tune, or review alerts from the Hermes injection-AV detection engine. Activates for STRATCOM hardening tasks, MCP-bridge fetch hardening, Hindsight write-gating, Polymarket and weather feed scanning, or any 24/7 autonomous-loop safety review tied to LOOP:656c99ef." license: MIT metadata: author: Strategist version: '1.0' loop: '656c99ef' sprint: HERMES-012 stack: hermes-v0.10.0+oMLX+Opik+Hindsight+PerplexityMCP tailnet_only: 'true'

Hermes Injection-AV Skill

System-wide prompt-injection detection engine for the Hermes agent loop. Acts as A/V: every untrusted byte that enters the loop (web fetches, MCP tool outputs, Polymarket / weather / Solana feeds, GitHub content, agent handoffs) is sanitized, scored, gated, and logged. Confirmed hits fan out as notifications to ss on Telegram and to Opik for review.

When to Use This Skill

Activate for any of these:

• "install / start / stop / status / restart the injection AV"
• "scan this URL / file / payload for prompt injection"
• "scan Hindsight for stored injections" (retro sweep)
• "review injection alerts" or "what did the AV catch overnight"
• "tune the detector" / "lower false positives" / "add a signature"
• "wire the AV into the Perplexity MCP bridge"
• "is the injection AV healthy"
• "rotate the canary" / "audit the canary log"
• Any STRATCOM hardening or pre-trading safety review

Do not activate for general security questions unrelated to Hermes, or for non-prompt-injection threat models.

Operating Constraints (code-law)

• macOS / zsh only, Apple Silicon native
• pathlib only, no heredoc, no # comments in shipped code
• No venv. Use system python3 on M5 / M4
• Tailnet-only. NEVER run tailscale funnel. No public exposure
• ZERO-GUESS: every signature traces to references/REFERENCES.md
• Daemon binds 127.0.0.1 only, plus optional tailnet-serve HTTPS
• No port or exposure changes without explicit Shag command + warning
• Read-only by default. Enforcement modes are opt-in per-layer
• [COMMIT:ID] and [DONE:ID]+next markers required on changes

Architecture

Five enforced boundaries plus a coordinating daemon:

raw_fetch -> sanitizer -> quarantine -> structured_summary
                                             |
                                             v
                                      orchestrator (ss)
                                             |
                          tool_gate (per-phase allowlist)
                                             |
                                             v
                                   memory_gate -> Hindsight

detection/ runs in parallel at every boundary and feeds the
hermes_inj_av daemon, which fans out alerts.

Layer responsibilities:

1. sanitizer/ strips HTML comments, blocklisted tags, zero-width Unicode, U+E0000 tag block, ANSI escapes, data URLs, markdown image payloads. Wraps output in <UNTRUSTED_WEB_CONTENT> delimiters with a sha256 hash.
2. quarantine/ runs a tool-less extractor model that emits only schema-validated JSON. Drops unknown fields, propagates an injection_suspected flag.
3. memory_gate/ refuses raw text writes to Hindsight. Allowlisted kind values only, scrubbed and size-capped.
4. tool_gate/ per-phase allowlist (research / analysis / decision / execution / post_trade). Research cannot place orders or sign txs.
5. detection/ weighted-pattern scorer + role-tag detector + Cf-char accumulator + per-iteration canary token.

The daemon (scripts/hermes_inj_av.py) is the always-on coordinator.

Daemon: hermes_inj_av

Single-process FastAPI service on 127.0.0.1:9079, runs under launchd on M5 (orchestrator host). Exposes:

• POST /scan/text body: {source_url, content} -> sanitize + detect
• POST /scan/url body: {url} -> fetch via Perplexity MCP, then scan
• POST /quarantine/extract body: {schema_name, content, source_url}
• POST /memory/gate body: {kind, source_url, fields, injection_suspected}
• POST /tool/check body: {phase, tool}
• GET /canary/current -> active canary token + issued-at
• POST /canary/rotate -> rotate, logs old token to history
• GET /alerts/recent?since=... -> recent fan-out events
• GET /healthz -> liveness + per-layer mode (shadow / enforce)
• GET /metrics -> Prometheus text, counters per layer

Shadow vs enforce modes are per-layer, configured in assets/hermes_inj_av.toml. Default rollout: all layers shadow until Shag flips them, per the code-law staged plan.

Notification fan-out

On a confirmed hit (score >= 0.6, or canary leak, or memory_gate reject, or tool_gate denial), the daemon:

1. Logs structured event to Opik (hermes.injection_av.alert)
2. Writes to local SQLite at ~/.hermes/inj_av/alerts.db (append-only)
3. Sends Telegram DM to ss bot using telegram:5656962227 chat id (explicit target, channels_list is broken — DM only)
4. If severity >= critical and enforcement is on, blocks the offending payload and emits >SUPERSTAR:[review-injection-alert]

Severity ladder:

• info score 0.0 - 0.39, logged only
• low score 0.4 - 0.59, logged + Opik
• medium score 0.6 - 0.79, Opik + Telegram DM to ss
• high score 0.8 - 0.94, all of the above + block in enforce mode
• critical score >= 0.95 OR canary leak OR memory_gate raw-text write attempt -> all of the above + force phase=research lock

Instructions

Pick the matching workflow.

Install

1. Confirm current device with pc device use <id> if not already on M5
2. Run bash scripts/install.sh — copies the package to ~/code/hermes-agent-config/hermes_antiinjection/, drops the launchd plist at ~/Library/LaunchAgents/io.hermes.inj_av.plist, creates ~/.hermes/inj_av/ for state, and runs pytest on the bundled tests. Refuses to proceed if any test fails.
3. Print the staged-rollout banner: Stage A shadow only; ask Shag to confirm before any layer is moved to enforce.

Start / Stop / Status / Restart

• Start: launchctl load ~/Library/LaunchAgents/io.hermes.inj_av.plist
• Stop: launchctl unload ~/Library/LaunchAgents/io.hermes.inj_av.plist
• Status: curl -sS http://127.0.0.1:9079/healthz | jq
• Restart: stop then start, then healthz poll until ready

Always confirm healthz returns {"ok": true, ...} before declaring done. Never assume; ZERO-GUESS.

Ad-hoc scan

scripts/scan.py <url-or-file> posts to /scan/text or /scan/url and prints the SanitizationReport + DetectionReport side by side. Exits non-zero on severity >= medium so it composes into CI.

Retro sweep of Hindsight

scripts/retro_sweep.py reads existing Hindsight rows, runs detect() on text-bearing fields, and writes flagged rows to ~/.hermes/inj_av/retro_sweep_<utc>.jsonl. Read-only — never mutates Hindsight. If hits found, emits >SUPERSTAR:[review-retro-sweep].

Tune the detector

Open references/SIGNATURES.md first. Every change must:

1. Cite a public source in the same edit
2. Include a regression test in hermes_antiinjection/tests/test_detector.py
3. Run the full pytest suite green before commit
4. Commit with [COMMIT:HERMES-012-AV-N] marker

Never silently lower a weight. Tuning down requires a documented false-positive corpus path.

Wire into the Perplexity MCP bridge

See references/INTEGRATION_MCP.md for the splice point. The patch replaces the bridge's raw fetch return with a call to POST /scan/text and substitutes the wrapped content on response. Default mode shadow — bridge still returns content, but every fetch is logged and scored.

Canary management

A fresh canary is issued at daemon start and rotated every 6 hours by default. Outbound payloads from quarantined boundaries are checked for the active and last-3 canaries. Any leak is critical, regardless of score.

Review alerts

scripts/review_alerts.py --since "1h ago" summarizes recent alerts: counts by severity, top sources, top matched patterns, canary status. Output is suitable for the daily STRATCOM brief.

Output Contract

Every skill invocation that performs an action MUST end with:

[DONE:HERMES-012-AV-<n>]+next: <what to do next>
>SUPERSTAR:[<one explicit action for ss>]+[CANARY:v3.0|bal=$]

Read-only queries (status, review, scan-only) end with the >SUPERSTAR line but no [DONE] marker.

Examples

Example 1: status check

User: "is the injection AV healthy"

Steps:

1. curl -sS http://127.0.0.1:9079/healthz | jq
2. Parse ok, per-layer mode, uptime, canary age, alert counts last 24h
3. Report concisely. If ok=false or canary age > 6h, raise it.

End with: >SUPERSTAR:[rotate-canary if age>6h, else none]+[CANARY:v3.0|bal=$]

Example 2: scan a Polymarket URL

User: "scan https://polymarket.com/event/houston-95f-may-15"

Steps:

1. POST /scan/url with the URL
2. Print sanitizer report (bytes_in/out, removed counts, hits)
3. Print detector report (score, matched patterns, role tags, Cf chars)
4. If severity >= medium, also print the Telegram DM that was sent

End with [DONE:HERMES-012-AV-scan]+next: ... and the >SUPERSTAR line.

Example 3: tuning request

User: "lower the false positive on 'developer mode' for legitimate release notes"

Steps:

1. Refuse to silently lower the weight
2. Ask for a corpus of 10+ legitimate examples that triggered
3. Once provided, write a context-aware regex (e.g. require proximity to you are now, act as, or jailbreak co-occurrence)
4. Add regression test, cite source in REFERENCES.md, run pytest
5. Commit with [COMMIT:HERMES-012-AV-tune-N] marker

Files Bundled

SKILL.md
scripts/
    install.sh                Install + launchd registration + tests
    hermes_inj_av.py          The daemon (FastAPI on 127.0.0.1:9079)
    scan.py                   Ad-hoc URL / file scanner
    retro_sweep.py            Read-only Hindsight scan
    review_alerts.py          Alert summarizer
    notifier.py               Telegram + Opik fan-out
    store.py                  SQLite alert store
references/
    REFERENCES.md             Every signature traced to public sources
    SIGNATURES.md             Pattern weights and rationale
    INTEGRATION_MCP.md        Perplexity MCP splice point
    THREAT_MODEL.md           Assets, adversaries, mappings
    ROLLOUT.md                3-stage code-law rollout
assets/
    hermes_inj_av.toml        Default config (all layers shadow)
    io.hermes.inj_av.plist    launchd plist template

Safety Rails

• The skill never edits Hindsight, never sends trades, never opens ports beyond loopback unless Shag explicitly toggles tailnet_serve = true in the config and acknowledges the warning.
• The skill never modifies its own signature weights without a cited source diff.
• The skill never auto-promotes a layer from shadow to enforce.
• The skill never disables itself. Stop is always an explicit Shag action via launchctl.