chore(catalog): review disclosures and floors for the sweep-1105 maintainer copy

Disclosure lines from the 1105 catalog review for makernice, habitude,
blackbox, adaption, cliproxyapi-provider, cpa-status, ethics-filter and
soul-finder; onda requires_hermes >=0.22.0 (portable-package support).

plugin-catalog/adaption.yaml

@@ -2,7 +2,7 @@ name: adaption
 title: Adaption
 repo: https://github.com/adaptionlabs/adaption-hermes-plugin
 sha: 3ab5264a043ea65ad03f2fbad841219d9649fb6a
-description: "Dataset import, adaptation, augmentation, translation, localization, synthetic generation (Invent), and AutoScientist fine-tuning through Adaption's hosted MCP server, with three workflow skills bundled. Agent Plugins v1 package (plugin.json + mcp.json + skills/), configuration only. Disclosure — every tool call goes to Adaption's hosted server (api.prod.adaptionlabs.ai) and acts on the user's Adaption account; the tool set is served by that server at runtime and is not covered by the pinned sha. Sign-in runs the pinned mcp-remote@0.1.49 through npx (Node.js 20.18.1+ and npm required) with Adaption's pre-registered public OAuth client, which opens a browser and a local callback port on first use and stores OAuth tokens under ~/.mcp-auth. Launching runs spends Adaption credits; the package marks the server untrusted, so Hermes asks before every tool the server does not mark read-only (including cost estimates) and refuses them in unattended runs."
+description: "Dataset import, adaptation, augmentation, translation, localization, synthetic generation (Invent), and AutoScientist fine-tuning through Adaption's hosted MCP server, with three workflow skills bundled. Agent Plugins v1 package (plugin.json + mcp.json + skills/), configuration only. Disclosure — every tool call goes to Adaption's hosted server (api.prod.adaptionlabs.ai) and acts on the user's Adaption account, tagged with a fixed hermes-plugin source parameter and header; the tool set is served by that server at runtime and is not covered by the pinned sha. Sign-in runs the pinned mcp-remote@0.1.49 through npx (Node.js 20.18.1+ and npm required; its own npm dependencies resolve to their latest matching versions at first run) with Adaption's pre-registered public OAuth client, which opens a browser and a local callback port on first use and stores OAuth tokens under ~/.mcp-auth. Launching runs spends Adaption credits; the package marks the server untrusted, so Hermes asks before every tool the server does not mark read-only (including cost estimates) and refuses them in unattended runs."
 maintainer: adaptionlabs
 tier: community
 category: tools

plugin-catalog/blackbox.yaml

@@ -3,7 +3,7 @@ repo: https://github.com/umanitek/agent-blackbox
 sha: f9224a3cda4a784ccac46576bb4f1b4fa02f5440
 subdir: plugins/blackbox
 title: Agent Blackbox
-description: "Security for agents: checks every tool call and model request before it runs against a curated, verifiable threat graph (prompt injection, dangerous commands, malicious packages, unsafe skills, phishing and drainer indicators) and local rules that keep an agent away from wallet stores, seed phrases, private keys and exchange API keys. Audit mode records; block mode refuses. Can share privacy-safe threat reports with an open community graph once the user turns sharing on (off by default); community findings only ever flag. Hooks only: no tools, no middleware. Disclosure — hooks see every tool call and model request; `hermes blackbox setup` installs Node (via a checksum-pinned nvm installer) if missing, the OriginTrail DKG node from npm (checksum-pinned) and Blazegraph in Docker or Oxigraph, registers the DKG node and the dashboard as login services (systemd/LaunchAgent), and joins the DKG peer-to-peer network; package installs are looked up on api.osv.dev (name and version); community threat reports signed by a local reporter key (threat identifiers, including domains of fetched pages that served a verified injection) are shared to the community graph only after you turn sharing on (off by default); the optional LLM reviewer sends the current turn's user and tool text to OpenAI or Anthropic; `blackbox attach` copies the plugin into the Hermes homes/profiles and OpenClaw workspaces you name and enables it in their config (automatic attaching is off unless you set `auto_attach: true`); `hermes blackbox chat` creates an `agent-blackbox` profile cloned from the current one (config.yaml and .env); the dashboard runs on 127.0.0.1:9700."
+description: "Security for agents: checks every tool call and model request before it runs against a curated, verifiable threat graph (prompt injection, dangerous commands, malicious packages, unsafe skills, phishing and drainer indicators) and local rules that keep an agent away from wallet stores, seed phrases, private keys and exchange API keys. Audit mode records; block mode refuses. Can share privacy-safe threat reports with an open community graph once the user turns sharing on (off by default); community findings only ever flag. Hooks only: no tools, no middleware. Disclosure — hooks see every tool call and model request; `hermes blackbox setup` installs Node (via a checksum-pinned nvm installer) if missing, the OriginTrail DKG node from npm (checksum-pinned) and Blazegraph in Docker or Oxigraph, registers the DKG node and the dashboard as login services (systemd/LaunchAgent), joins the DKG peer-to-peer network, and asks the threat graph's owner to admit the node (its node address; admission to sync only, not sharing); package installs are looked up on api.osv.dev (name and version); community threat reports signed by a local reporter key (threat identifiers, including domains of fetched pages that served a verified injection) are shared to the community graph only after you turn sharing on (off by default); the optional LLM reviewer sends the current turn's user and tool text to OpenAI or Anthropic; `blackbox attach` copies the plugin into the Hermes homes/profiles and OpenClaw workspaces you name and enables it in their config (automatic attaching is off unless you set `auto_attach: true`); `hermes blackbox chat` creates an `agent-blackbox` profile cloned from the current one (config.yaml and .env); the dashboard runs on 127.0.0.1:9700."
 maintainer: Umanitek
 tier: community
 category: tools

plugin-catalog/cliproxyapi-provider.yaml

@@ -1,7 +1,7 @@
 name: cliproxyapi-provider
 repo: https://github.com/duu261/hermes-cliproxyapi-provider
 sha: 08fdae8c4607851ac25a2870c19139f961cc95b7
-description: "CLIProxyAPI as native Hermes model providers: discovers each CPA provider group (Claude, Codex, xAI, Gemini, Kiro and others) and registers one profile per group on the wire its CPA executor accepts (Anthropic Messages, Responses or Chat Completions), with context windows and reasoning levels from CPA. Disclosure: sends model-list and inference requests, authenticated with the API key env var you name, to the CPA base_url you configure; with an optional management key it also makes bounded read-only GETs to CPA's management API; with an optional billing route it sends inference, and a model-list GET, to the gateway URL you configure, authenticated with the gateway key env var you name. Known limit: Hermes strips from agent subprocesses only the key env vars a registered provider declares, so the management key env var, and on a routed instance the CPA key env var, stay readable by agent shells. Writes its model cache under $HERMES_HOME/cache/cliproxyapi/, plus lock files and a rejected-key marker (salted HMAC, never a key) under $HERMES_HOME/cache/cliproxyapi/locks/."
+description: "CLIProxyAPI as native Hermes model providers: discovers each CPA provider group (Claude, Codex, xAI, Gemini, Kiro and others) and registers one profile per group on the wire its CPA executor accepts (Anthropic Messages, Responses or Chat Completions), with context windows and reasoning levels from CPA. Disclosure — sends model-list and inference requests, authenticated with the API key env var you name, to the CPA base_url you configure; with an optional management key it also makes bounded read-only GETs to CPA's management API; with an optional billing route it sends inference, and a model-list GET, to the gateway URL you configure, authenticated with the gateway key env var you name. Known limit: Hermes strips from agent subprocesses only the key env vars a registered provider declares, so the management key env var, and on a routed instance the CPA key env var, stay readable by agent shells. Writes its model cache under $HERMES_HOME/cache/cliproxyapi/, plus lock files and a rejected-key marker (salted HMAC, never a key) under $HERMES_HOME/cache/cliproxyapi/locks/."
 maintainer: duu261
 tier: community
 category: models

plugin-catalog/cpa-status.yaml

@@ -2,7 +2,7 @@ name: cpa-status
 repo: https://github.com/duu261/hermes-cliproxyapi-provider
 sha: 08fdae8c4607851ac25a2870c19139f961cc95b7
 subdir: cpa-status
-description: "/cpa in chat for CLIProxyAPI (CPA) pools: account health per provider (active, limited, cooling, error, disabled), the CPA version with an update hint, and on request each account's live quota (Claude, Codex, xAI, Antigravity, Devin, Kimi, Kiro), the same usage reads as CPA's own web UI. Companion to cliproxyapi-provider and reads the same cliproxyapi config. Disclosure: only when you type the command, and with the management key env var you name per instance: GET the credentials list and CPA's own update check (at most once per 6 hours); for /cpa quota, POST CPA's api-call so CPA makes each built-in vendor's usage request with that account's token (Antigravity and Devin are vendor POSTs, the rest GETs), and GET CPA plugin quota for Kiro; at most 20 accounts, 4 requests in flight. Stops at the first rejected key: one failed try, or up to 4 if the key is revoked mid-run; CPA bans an IP after five failed management logins. Writes only lock files and a rejected-key marker (salted HMAC, never a key) under $HERMES_HOME/cache/cliproxyapi/locks/. Known limit: Hermes strips from agent subprocesses only the key env vars a registered provider declares, so the management key env var stays readable by agent shells."
+description: "/cpa in chat for CLIProxyAPI (CPA) pools: account health per provider (active, limited, cooling, error, disabled), the CPA version with an update hint, and on request each account's live quota (Claude, Codex, xAI, Antigravity, Devin, Kimi, Kiro), the same usage reads as CPA's own web UI. Companion to cliproxyapi-provider and reads the same cliproxyapi config. Disclosure — only when you type /cpa, and with the management key env var you name per instance: GETs the credentials list from your configured CPA and CPA's own update check (at most once per 6 hours); for /cpa quota, POSTs CPA's api-call so CPA sends each built-in vendor's private usage request (Anthropic, ChatGPT/Codex, xAI, Google Antigravity, Codeium/Devin, Kimi) with that account's token, using the vendor clients' own User-Agent and client headers as CPA's web UI does (Antigravity and Devin are vendor POSTs, the rest GETs), and GETs CPA plugin quota for Kiro; at most 20 accounts, 4 requests in flight. Stops at the first rejected key: one failed try, or up to 4 if the key is revoked mid-run; CPA bans an IP after five failed management logins. Writes only lock files and a rejected-key marker (salted HMAC, never a key) under $HERMES_HOME/cache/cliproxyapi/locks/. Known limit: Hermes strips from agent subprocesses only the key env vars a registered provider declares, so the management key env var stays readable by agent shells."
 maintainer: duu261
 tier: community
 category: models

plugin-catalog/ethics-filter.yaml

@@ -4,7 +4,7 @@ sha: f117850d99c9dbcac0aab84625f50cc7a6853108
 subdir: plugin
 version: "1.1.0"
 title: Ethics Filter
-description: "Score any decision across six ethics modules — environmental, fairness, transparency, leadership, framework, compliance — and get GREEN, AMBER or RED back with the reasoning attached. Ships /ethics and the ethics_evaluate tool. Disclosure — reads the rubrics and constitution templates bundled in the plugin and appends one JSONL record per scored evaluation (decision text, context and reasoning included) to $ETHICS_FILTER_AUDIT, default ~/.ethics-filter/audit.jsonl outside the Hermes profile; that file is never rewritten or deleted. With auto_score=true it asks the host agent's own model to score through Hermes, holding no separate key; no other network calls."
+description: "Score any decision across six ethics modules — environmental, fairness, transparency, leadership, framework, compliance — and get GREEN, AMBER or RED back with the reasoning attached. Ships /ethics and the ethics_evaluate tool. Disclosure — reads the rubrics and constitution templates bundled in the plugin and appends one JSONL record per scored evaluation (decision text, context and reasoning included) to $ETHICS_FILTER_AUDIT, default ~/.ethics-filter/audit.jsonl outside the Hermes profile and shared by every profile; that file is never rewritten or deleted. With auto_score=true it asks the host agent's own model to score through Hermes, holding no separate key; no other network calls."
 maintainer: RegeneratusLabs
 tier: community
 category: tools

plugin-catalog/habitude.yaml

@@ -2,7 +2,7 @@ name: habitude
 repo: https://github.com/legott-ai/habitude-agent-integrations
 sha: 5802d0c9680f93a56440439bbfba189c80f1ec3f
 subdir: hermes
-description: Read-only journal reflection skill with opt-in local Vault MCP setup.
+description: "Read-only journal reflection skill with opt-in local Vault MCP setup. Disclosure — after you run the bundled setup and add its local stdio MCP server yourself, the plugin reads Markdown notes from the one Vault directory you name (read-only), keeps its settings in ~/.config/habitude-agent/config.json and a search index in ~/.cache/habitude-agent/ (outside the Hermes profile), and returned journal excerpts are sent to your configured model provider; it makes no network calls of its own."
 maintainer: IkwhanChang
 tier: community
 category: tools

plugin-catalog/makernice.yaml

@@ -3,7 +3,7 @@ title: Makernice
 repo: https://github.com/makernice/makernice-plugin
 sha: ebdff055312c9e19f27caa0fe108661d64e74643
 version: "0.2.0"
-description: "Makernice video and image generation through Makernice's remote MCP server (Streamable HTTP at https://mcp.makernice.com/mcp, OAuth sign-in in the browser, no API key in config): Seedance, Kling, Wan and MiniMax videos and Seedream and Qwen images. Every job is priced in USD before it runs and refused if it exceeds the cap the user approved. Bundles four skills: setup, product video, trend remix and cost planner. Agent Plugins v1 package (plugin.json + mcp.json + skills/), configuration only. Disclosure: hosted-only connector with no local code; prompts, image links and job parameters are sent to mcp.makernice.com; generate spends the user's prepaid Makernice balance. A job that fails releases its held amount, but a finished output blocked by moderation is still charged. Sign-in needs a same-name mcp_servers entry with auth: oauth in config.yaml (shown in the README); Hermes stores and refreshes the OAuth token. The package marks the server untrusted, so Hermes asks before write-capable calls and refuses them in unattended runs; a same-name config.yaml entry replaces that setting, so add trust: untrusted to it to keep the approvals. The tool set is served by the remote server at runtime and is not covered by the pinned sha."
+description: "Makernice video and image generation through Makernice's remote MCP server (Streamable HTTP at https://mcp.makernice.com/mcp, OAuth sign-in in the browser, no API key in config): Seedance, Kling, Wan and MiniMax videos and Seedream and Qwen images. Every job is priced in USD before it runs and refused if it exceeds the cap the user approved. Bundles four skills: setup, product video, trend remix and cost planner. Agent Plugins v1 package (plugin.json + mcp.json + skills/), configuration only. Disclosure — hosted-only connector with no local code; prompts, image links and job parameters are sent to mcp.makernice.com; generate spends the user's prepaid Makernice balance. A job that fails releases its held amount, but a finished output blocked by moderation is still charged. Sign-in needs a same-name mcp_servers entry with auth: oauth in config.yaml (shown in the README); Hermes stores and refreshes the OAuth token. The package marks the server untrusted, so Hermes asks before write-capable calls and refuses them in unattended runs; a same-name config.yaml entry replaces that setting, so add trust: untrusted to it to keep the approvals. The tool set is served by the remote server at runtime and is not covered by the pinned sha."
 maintainer: Makernice Team
 tier: community
 category: tools

plugin-catalog/onda.yaml

@@ -18,3 +18,4 @@ capabilities:
   requires_env: []
 known_issues:
 - "Sign-in needs one extra command after install, because a portable plugin cannot declare an OAuth MCP server: hermes mcp add onda --url https://api.getonda.ru/mcp --auth oauth --connect-timeout 300"
+requires_hermes: ">=0.22.0"

plugin-catalog/soul-finder.yaml

@@ -3,7 +3,7 @@ repo: https://github.com/RegeneratusLabs/Soul-Finder
 sha: 2d288de288f220f3a630fa41ca9bd0bc9801e992
 version: "1.1.0"
 title: Soul Finder
-description: "Build or fix your agent's SOUL.md — the personality file behind every reply. A few plain questions draft one from scratch; /soul audits a stale one and ships a diff. Disclosure — reads $HERMES_HOME/SOUL.md and writes it only through the agent's own file tools after you approve the draft (the bundled skill can suggest copying the approved file into other profiles' SOUL.md, again only on approval); writes two booleans (nudge_sent, flow_complete) to its own plugin-data state so the first-run offer happens once. No network I/O, no credentials."
+description: "Build or fix your agent's SOUL.md — the personality file behind every reply. A few plain questions draft one from scratch; /soul audits a stale one and ships a diff. Disclosure — reads $HERMES_HOME/SOUL.md and writes it only through the agent's own file tools after you approve the draft (the bundled skill can suggest copying the approved file into other profiles' SOUL.md, again only on approval); on a profile with no real SOUL.md it makes a one-time offer through a system-prompt section and an injected first-run message, and writes two booleans (nudge_sent, flow_complete) to its own plugin-data state so the offer happens once. No network I/O, no credentials."
 maintainer: RegeneratusLabs
 tier: community
 category: tools