Bind the exact action
The signed response carries a canonical SHA-256 binding over the command, resolved target, environment, repo, working directory, branch, commit, and diff context.
Portable Agent Skill
Put a fail-closed safety gate before consequential agent actions.
Install one standards-compliant SKILL.md package for Codex, Claude Code, Cursor, and other Agent Skills clients. With authorized, redacted metadata, it binds the exact action, calls the one-cent Hermes gate, and pauses risky or unresolved execution.
Install
Add only the Action Safety skill
The Agent Skills CLI discovers the package by its frontmatter name and installs it into your selected agent. Review the public file before installing.
npx skills@1.5.18 add JesseGdotIO/HermesPlant --skill protect-agent-actionThe CLI documents anonymous telemetry by default. The skill is public, but you can opt out:
macOS / Linux
DISABLE_TELEMETRY=1 npx skills@1.5.18 add JesseGdotIO/HermesPlant --skill protect-agent-actionPowerShell
$env:DISABLE_TELEMETRY='1'; npx skills@1.5.18 add JesseGdotIO/HermesPlant --skill protect-agent-actionControl model
The result advises; your policy remains authoritative
Fail closed
Timeouts, malformed responses, classifier mismatches, unknown routes, quota failures, and unapproved payment challenges leave the action unexecuted.
Route by risk
Low risk still needs local permission. Medium risk requires full evidence. High or critical risk pauses for the complete workflow.
Never invent approval
ReviewQueue creates deterministic triage. A separate authenticated approval system must make the human decision.
Trust boundary
The skill requires an existing data-sharing policy, never treats a remote allow as permission, never follows an arbitrary recommended URL, never sends secrets, and never converts review triage into approval. For x402, it requires exact route price, Base USDC terms, recipient, and retry identity checks.