hermes-agent

maintainer y0uCeF · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install commands are used to install dependencies from the project's own source tree (local '.[all]' and extras), not from external untrusted packages; this is normal for venv-based Python projects and poses no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install commands are used to install dependencies from the project's own source tree (local '.[all]' and extras), not from external untrusted packages; this is normal for venv-based Python projects and poses no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:76 venv/bin/pip install .[all]
PKGBUILD:77 venv/bin/pip install .[messaging,edge-tts,firecrawl,exa,parallel-web]

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Youcef <youcef.nafa@gmail.com>
    
      2# Co-maintainer: Evert <evorster at gmail dot com>
    
      3# This package uses a venv-based installation inspired by the official NousResearch install.sh. It swaps off uv with python311's venv since python 3.11 is the latest version supported by the developer. The venv solution allows the inclusion of all nodejs modules inside the package's /opt as opposed to shipping the package following ArchLinux convensions (/usr/share,/usr/lib,/usr/bin).
    
      4# Optional dependencies are dissociated from arch and need to be installed manually into venv. Although, many are installed by hermes lazyly when needed.
    
      5# TODO: there needs to be a way to copy skills upon hermes package update, or, at least, to prompt the user to do so.
    
      6pkgname=hermes-agent
    
      7pkgver=0.18.2
    
      8_tagver=2026.7.7.2
    
      9pkgrel=1
    
      10pkgdesc="Locally-run AI agent with tool use, web browsing, and automation"
    
      11arch=('any')
    
      12url="https://github.com/NousResearch/hermes-agent"
    
      13license=('MIT')
    
      14groups=()
    
      15depends=(
    
      16    'python311'
    
      17    'ripgrep'
    
      18    'ffmpeg'
    
      19    'nss'
    
      20    'atk'
    
      21    'at-spi2-core'
    
      22    'cups'
    
      23    'libdrm'
    
      24    'libxkbcommon'
    
      25    'mesa'
    
      26    'pango'
    
      27    'cairo'
    
      28    'alsa-lib'
    
      29)
    
      30
    
      31makedepends=('python311' 'nodejs' 'npm' 'rsync')
    
      32source=("https://github.com/NousResearch/hermes-agent/archive/refs/tags/v${_tagver}.tar.gz")
    
      33sha256sums=('f5d1022eed3763a768cf7b0f0844831f0170a35f54eb8d18223f2e93f503025e')
    
      34validpgpkeys=()
    
      35install=hermes-agent.install
    
      36
    
      37build() {
    
      38  cd "${pkgname}-${_tagver}"
    
      39
    
      40  # vite-plugin-tailwindcss uses the ignore package which walks up the tree to read
    
      41  # .gitignore files. Creating an empty .git directory stops the scan at this level.
    
      42  [ ! -d .git ] && mkdir .git
    
      43
    
      44  echo "==> Installing Node.js dependencies..."
    
      45  if [ -f "package.json" ]; then
    
      46    npm install || return 1
    
      47  fi
    
      48
    
      49  echo "==> Building frontend..."
    
      50  if [ -d "web" ]; then
    
      51    cd web
    
      52    npm install || return 1
    
      53    npm run build || return 1
    
      54    cd ..
    
      55  fi
    
      56
    
      57  echo "==> Building TUI..."
    
      58  # hermes_cli.main sets PROJECT_ROOT to its installed site-packages parent and
    
      59  # expects the modern TUI at PROJECT_ROOT/ui-tui. Build that directory here and
    
      60  # package it into the venv's site-packages below.
    
      61  if [ -d "ui-tui" ]; then
    
      62    cd ui-tui
    
      63    npm install --no-fund --no-audit --progress=false || return 1
    
      64    npm run build || return 1
    
      65    cd ..
    
      66  fi
    
      67
    
      68  echo "==> Installing whatsapp-bridge dependencies..."
    
      69  # Install whatsapp-bridge dependencies (kept alongside scripts for same path)
    
      70  if [ -f "scripts/whatsapp-bridge/package.json" ]; then
    
      71    (cd scripts/whatsapp-bridge && npm install --legacy-peer-deps --omit=dev) || return 1
    
      72  fi
    
      73
    
      74  echo "==> Creating Python venv and installing dependencies..."
    
      75  python3.11 -m venv --clear venv || return 1
    
      76  venv/bin/pip install .[all]
    
      77  venv/bin/pip install .[messaging,edge-tts,firecrawl,exa,parallel-web]
    
      78}
    
      79
    
      80package() {
    
      81  cd "${pkgname}-${_tagver}"
    
      82
    
      83  # Install to /opt
    
      84  _optdir="$pkgdir/opt/$pkgname"
    
      85  install -d "$_optdir"
    
      86
    
      87  # Copy application files
    
      88  rsync -a --exclude='__pycache__' --exclude='.git' \
    
      89  --exclude='node_modules' --exclude='web/src' \
    
      90  --exclude='web/package.json' --exclude='web/package-lock.json' \
    
      91  --exclude='web/vite.config.ts' --exclude='web/tsconfig*.json' \
    
      92  --exclude='web/eslint.config.js' --exclude='web/README.md' \
    
      93  --exclude='ui-tui/src' --exclude='ui-tui/node_modules' \
    
      94  --exclude='scripts/tests' --exclude='scripts/install.*' \
    
      95  --exclude='build' \
    
      96  . "$_optdir/"
    
      97
    
      98  # Add symlink to ui-tui in site-packages, hermes keeps looking for things inside site-packages
    
      99
    
      100  echo "console.log('skipping build, using prebuilt dist/entry.js')" > "$_optdir/ui-tui/scripts/build.mjs"
    
      101
    
      102  # Create simple wrapper script in /usr/bin.
    
      103  # Set HERMES_TUI_DIR so the launcher uses the prebuilt bundle without
    
      104  # trying to rebuild via esbuild at runtime (which would fail on the
    
      105  # root-owned site-packages tree).
    
      106  sed -i '1c#!/opt/hermes-agent/venv/bin/python3.11' $_optdir/venv/bin/hermes 
    
      107
    
      108  install -d "$_optdir/venv/lib/python3.11/site-packages"
    
      109  {
    
      110      echo "import sys; sys.path.insert(0, \"/opt/$pkgname\")"
    
      111  } > "$_optdir/venv/lib/python3.11/site-packages/hermes.pth"
    
      112
    
      113  install -d "$pkgdir/usr/bin"
    
      114  {
    
      115    echo "#!/bin/bash"
    
      116    echo "unset PYTHONPATH"
    
      117    echo "unset PYTHONHOME"
    
      118    echo "exec /opt/$pkgname/venv/bin/hermes" '"$@"'
    
      119  } > "$pkgdir/usr/bin/hermes"
    
      120
    
      121  chmod 755 "$pkgdir/usr/bin/hermes"
    
      122}
    
      123

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 11:20:06	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2