Hermes Agent 推出 Security 插件，可自动化审查代码库安全漏洞
Nous Research 给 Hermes Agent 出了 Security 插件，能扫你代码库的漏洞，还会写复现脚本跑一遍验证，报告直接导 SARIF。
Nous Research 为 Hermes Agent 发布官方 Security 插件。插件先梳理攻击者可达面和受信输入，再把代码拆分给并行 subagent 检查，并对每个候选漏洞验证攻击者是否真的可利用。开启 test confirmation 后，Hermes 会为每个漏洞写出小型复现脚本，在仓库的临时副本里运行验证。报告记录证据和被排除的误报项，可导出为 SARIF 格式接入现有安全工具。入口支持聊天、CLI 和 Hermes Desktop 的 Security 页面。
Hermes Agent can now review your codebase for security bugs with the new official Security plugin by @mark_s.
Hermes first maps what an attacker could reach and which inputs it trusts. It splits the code across parallel subagents, checks every candidate finding against the code, and traces whether an attacker can actually exploit it.
Turn on test confirmation and Hermes writes a small reproduction for each finding and runs it in a temporary copy of the repo. Each report records the evidence and the findings Hermes ruled out, and exports to SARIF for your existing tools.
Run it from chat, the CLI, or the Security page in Hermes Desktop.
