shreyasudupi/hermes-plugin-detonator

Hermes Security reviews code you wrote. Detonator tests code you didn't.
Current version: v0.3.0 (what's new)
▶️ Watch the 82-second demo: a real run catching a fake key-stealer plugin, comparing two versions, the clock jump, and the plain-words AI explanation.
Detonator is a security sandbox for Hermes Agent
plugins. You point it at a plugin at an exact commit and approve the run. It then
loads that plugin inside a disposable Docker container with a fake Hermes home full
of decoys, fires synthetic hooks and tool calls at it, and reports what the plugin
actually did compared with what it declares. Each finding says, in plain words, why it
matters and which MITRE ATT&CK / ATLAS technique it matches.
Since v0.3 it watches each run from two sides: a monitor inside the plugin's Python process,
and an outside monitor in separate containers the plugin cannot reach (a system-call
tracer and a fake internet). A plugin that hides from or switches off the inside monitor,
or writes a fake clean result, is still caught. See Outside monitor.
Tested on Linux (x86_64), macOS on Apple Silicon (Docker Desktop) and Windows (Docker
Desktop with WSL 2, in both the hermes terminal chat and the Desktop app). Every change runs
the full test suite and Hermes's own hermes plugins validate in CI, including on Windows.
In the Desktop app, the very first /detonate can show "request timed out after 30s" while
the sandbox image builds (Desktop gives a slash command 30 seconds). Run the same command
again: the image is built by then, and runs take seconds. Or run the first one in the
hermes terminal chat, which has no limit.
## Try it in 60 seconds
You need Docker running and Hermes installed.
Not sure Docker is ready? Type /detonate check in Hermes: it only asks Docker for its
status, runs nothing, and tells you what to fix (see Docker problems).
One command installs it, switches it on and restarts Hermes's plugin host so it loads:
bash
hermes plugins install shreyasudupi/hermes-plugin-detonator && hermes plugins enable detonator && hermes gateway stop
hermes
On Windows PowerShell 5, use ; instead of &&. New to Hermes or Docker? The
step-by-step quickstart starts from nothing, on macOS, Windows and Linux.
In the Hermes chat:
/detonate [subdir]
Detonator asks before it does anything, and you choose the test:
Run full test: inside and outside monitors. It also catches plugins that hide what they do
or fake a clean result, and takes a second or two longer.
Run quick test: inside monitor only. A little faster, but a plugin that hides what it does or
fakes its own report can fool it.
Every report starts with the test mode it used, and a quick test's report lists what it did not
check, so a clean quick result is not mistaken for a clean full one. The first run builds the sandbox images (a minute or two);
after that a run takes seconds:
🔴 DANGEROUS: the plugin did something stealers and malware do (took or leaked decoy secrets, ...).
[critical] Read Hermes's .env file, where your API keys are kept, and also reached for the network or other secrets (T1552.001, AML.T0055)
Why: It read your API keys and, in the same run, reached for the network or took other secrets. ...